Have I Been Pwned Breaches Catalog Scraper

Have I Been Pwned Breaches Catalog Scraper

Scrape the complete Have I Been Pwned breach catalog, filter by domain, or fetch a single breach by name. Each record includes the breach title, date, compromised accounts, and the data classes exposed. Export to CSV, JSON, Excel, or XML.

Security researchers and incident responders need a structured view of every publicly documented data breach. The Have I Been Pwned website lists them, but there is no bulk export. This Actor reads the breach catalog directly and returns each entry as a clean row, ready for analysis.

You can pull the entire catalog, filter breaches linked to a specific domain, or retrieve the details of one named breach.

Who uses it	What they scrape Have I Been Pwned for
Security researchers	Build a local, searchable database of every documented breach for trend analysis.
Incident response teams	Check which breaches are associated with a domain they are investigating.
Compliance officers	Audit third-party vendors by reviewing breaches tied to their corporate domains.
Threat intelligence analysts	Enrich internal tools with a structured feed of breach metadata and exposed data classes.

What it does

This Actor collects breach records from the Have I Been Pwned catalog by full list, domain filter, or single breach name, and returns each one as a flat row.

• 📋 All breaches: fetch every entry in the Have I Been Pwned catalog, up to the limit you set.
• 🏢 Breaches by domain: return only the breaches associated with a domain you specify, such as adobe.com.
• 🎯 Single breach by name: retrieve the full record for one breach, for example Adobe or LinkedIn.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

What you can do with Have I Been Pwned data

🔍 Build a breach research database.

A security researcher runs the Actor in 'All breaches' mode weekly to maintain an up-to-date local copy of the HIBP catalog for longitudinal studies.

🏢 Audit a vendor's breach history.

A compliance team enters a third-party domain to list every breach that exposed that organization's data, supporting vendor risk assessments.

📊 Monitor breach trends over time.

An analyst schedules the Actor to collect new breaches monthly, tracking which data classes appear most often and how breach sizes change.

🎯 Enrich an incident report with breach details.

An incident responder fetches a single breach by name to include the exact compromised data classes and record count in a client-facing report.

Why choose this scraper

	What you get
Structured breach data	Every breach arrives as a flat row with a fixed schema, ready for databases or spreadsheets.
No API key required	Reads the public catalog pages directly. No registration, no OAuth, no rate-limit headaches.
Domain filtering built in	Query breaches by domain without scraping the whole catalog and filtering afterward.
Flexible output formats	Export your dataset to CSV, JSON, Excel, or XML from the Apify platform.

How it compares

No other Store actor targets Have I Been Pwned the same way, so the honest comparison is with the alternatives teams actually weigh.

	Have I Been Pwned Breaches Catalog Scraper	Build it in-house	By hand
Setup	Run it now, zero config	Days of engineering	None, but hours per pull
When Have I Been Pwned changes	Maintained for you	You fix it	You re-learn the page
Proxies, retries, anti-bot	Built in	Your problem	Browser only
Output	Fixed JSON schema, CSV/Excel export	Whatever you build	Copy-paste
Cost	Pay per result	Engineering time	Analyst hours

Configure the run

Drive the Actor by choosing a mode: list all breaches, filter by a domain, or target a single breach by its exact name. The max items limit controls how many records reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

{
  "maxItems": 10
}

A larger pull:

{
  "maxItems": 200
}

Pricing

Pay-per-result: $0.004 per result collected. You pay only for the results written to your dataset.

Results collected	Approximate cost
100 results	$0.40
1,000 results	$4.00
10,000 results	$40.00

New Apify accounts start with $5 in free credit.

Free users

Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.

Run it

1. Create a free Apify account with $5 in credit.
2. Open the Have I Been Pwned Breaches Catalog Scraper.
3. Set your inputs and any filters, then click Start.
4. Export the results as CSV, Excel, JSON, or XML from the Dataset tab.

Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.

Use with AI agents (MCP)

Give an AI agent live access to Have I Been Pwned through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

$claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/hibp-breaches-catalog-scraper"

Then prompt it in plain language to run the scraper and read back the results.

Troubleshooting

Why am I getting no results when I enter a domain?

Check that the domain is spelled correctly and that you have selected 'Breaches by domain' as the mode. The domain should match the format used by Have I Been Pwned, for example 'adobe.com' without a protocol or path.

The Actor returns fewer results than I expected.

The Have I Been Pwned catalog only includes breaches that have been publicly disclosed and verified. A domain may have fewer associated breaches than you anticipate. Also check that your max items limit is set high enough.

I get an error when fetching a single breach by name.

Ensure the breach name matches exactly, including capitalization and spacing. Try the name as it appears in the HIBP catalog, such as 'Adobe' rather than 'adobe' or 'Adobe Systems'.

The run takes a long time to complete.

Fetching the full catalog with a high max items limit will take longer because the Actor reads each breach page individually. Reduce the max items limit if you only need a subset.

Can I get the data classes for each breach?

Yes. The Actor collects the data classes field for each breach, which lists the types of data exposed, such as 'Email addresses', 'Passwords', or 'Credit cards'.

FAQ

Question	Answer
What data does the Have I Been Pwned breach catalog contain?	The catalog lists publicly disclosed data breaches. Each entry includes the breach name, the date it occurred, the number of compromised accounts, and the types of data exposed, such as email addresses, passwords, or credit card numbers.
Do I need an API key to scrape the HIBP breach catalog?	No. This Actor reads the public web pages of the Have I Been Pwned breach catalog. You do not need to register an application or obtain an API key.
Can I filter breaches by a specific domain?	Yes. Set the mode to 'Breaches by domain' and enter the domain you want to query. The Actor returns only the breaches associated with that domain.
How do I get the details of a single breach?	Set the mode to 'Single breach by name' and enter the exact breach name as it appears on Have I Been Pwned, for example 'Adobe' or 'LinkedIn'.
What is the maximum number of breaches I can scrape?	You can set the maximum up to 1,000,000 breaches per run. The full catalog contains far fewer entries, so this limit will not restrict a complete scrape.
What export formats are supported?	You can export your results to CSV, JSON, Excel, or XML directly from the Apify dataset tab.
Does this Actor include the breached email addresses or passwords?	No. The Have I Been Pwned breach catalog describes each breach but does not expose the actual compromised records. This Actor collects the breach metadata only.
Can I schedule this Actor to run automatically?	Yes. Apify supports scheduled runs. You can set this Actor to run daily, weekly, or on any cron schedule to keep your breach dataset current.
Is this Actor affiliated with Have I Been Pwned?	No. This is an independent scraper that reads publicly available pages from the Have I Been Pwned website. It is not built or endorsed by Have I Been Pwned.
What happens if I enter an invalid breach name?	The Actor will attempt to fetch the breach page. If the name does not match any entry in the catalog, the run will complete with no results.

Related actors

Browse the full ParseForge collection for more scrapers.

🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by Have I Been Pwned. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.