Data Breach Monitor

Know the day a new data breach is published — and specifically whether it touches a company you depend on.

Watches the Have I Been Pwned breach catalogue and reports only breaches that are new since your last run.

What you get per breach

title · domain · accounts (how many were exposed) · breachedAt · addedAt · dataClasses (passwords, credit cards, addresses…) · description (HTML stripped) · verified · sensitive · malware

Filtering

• domains — only breaches at companies you use, e.g. your vendors and SaaS suppliers
• dataClasses — only breaches exposing passwords, or payment data, or whatever matters
• minAccounts — ignore small breaches
• verifiedOnly — skip anything HIBP has not verified

Announced exactly once

A ledger of reported breach ids means nothing is sent twice. The first run records a baseline instead of announcing the entire historical catalogue of 900+ breaches at you — but it does not run silent: it pushes one baseline-summary row plus up to baselineSampleSize (default 10, set to 0 to disable) of the breaches currently matching your filters, each tagged isBaseline: true so they're never mistaken for a real "new breach" alert. That keeps the run's dataset genuinely non-empty and useful instead of silently returning nothing on day one. After that, every run reports only genuinely new entries.

Privacy note, stated plainly

This uses HIBP's public breach catalogue endpoint, which needs no API key. It does not look up individual email addresses — that is a separate, paid HIBP endpoint and is deliberately not used here. So this tells you "a company you rely on was breached", not "this specific person was in it".

Typical uses

Security teams tracking vendor and supply-chain risk · MSPs watching their clients' providers · compliance teams needing a documented monitoring control · researchers and journalists tracking breach volume · anyone who wants to force a password rotation the day it matters rather than a month later.