# Have I Been Pwned Breaches Catalog Scraper (`parseforge/hibp-breaches-catalog-scraper`) Actor

Scrapes the Have I Been Pwned breach catalog by full list, domain filter, or single breach name. Returns each breach as a flat row with title, date, compromised accounts, and exposed data classes.

- **URL**: https://apify.com/parseforge/hibp-breaches-catalog-scraper.md
- **Developed by:** [ParseForge](https://apify.com/parseforge) (community)
- **Categories:** Developer tools, Automation
- **Features:** Limited permissions
- **Stats:** 19 total users, 1 monthly users, 100.0% runs succeeded, 1 bookmarks
- **User rating**: No ratings yet

## Pricing

from $3.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

[![ParseForge](https://raw.githubusercontent.com/ParseForge/apify-assets/main/banner-v4.webp)](https://apify.com/parseforge?fpr=vmoqkp)

### Have I Been Pwned Breaches Catalog Scraper

**Scrape the complete Have I Been Pwned breach catalog, filter by domain, or fetch a single breach by name.** Each record includes the breach title, date, compromised accounts, and the data classes exposed. Export to CSV, JSON, Excel, or XML.

Security researchers and incident responders need a structured view of every publicly documented data breach. The Have I Been Pwned website lists them, but there is no bulk export. This Actor reads the breach catalog directly and returns each entry as a clean row, ready for analysis.

You can pull the entire catalog, filter breaches linked to a specific domain, or retrieve the details of one named breach.

| Who uses it | What they scrape Have I Been Pwned for |
|---|---|
| Security researchers | Build a local, searchable database of every documented breach for trend analysis. |
| Incident response teams | Check which breaches are associated with a domain they are investigating. |
| Compliance officers | Audit third-party vendors by reviewing breaches tied to their corporate domains. |
| Threat intelligence analysts | Enrich internal tools with a structured feed of breach metadata and exposed data classes. |

### What it does

This Actor collects breach records from the Have I Been Pwned catalog by full list, domain filter, or single breach name, and returns each one as a flat row.

- 📋 **All breaches:** fetch every entry in the Have I Been Pwned catalog, up to the limit you set.
- 🏢 **Breaches by domain:** return only the breaches associated with a domain you specify, such as adobe.com.
- 🎯 **Single breach by name:** retrieve the full record for one breach, for example Adobe or LinkedIn.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

### What you can do with Have I Been Pwned data

**🔍 Build a breach research database.**

A security researcher runs the Actor in 'All breaches' mode weekly to maintain an up-to-date local copy of the HIBP catalog for longitudinal studies.

**🏢 Audit a vendor's breach history.**

A compliance team enters a third-party domain to list every breach that exposed that organization's data, supporting vendor risk assessments.

**📊 Monitor breach trends over time.**

An analyst schedules the Actor to collect new breaches monthly, tracking which data classes appear most often and how breach sizes change.

**🎯 Enrich an incident report with breach details.**

An incident responder fetches a single breach by name to include the exact compromised data classes and record count in a client-facing report.

### Why choose this scraper

|  | What you get |
|---|---|
| **Structured breach data** | Every breach arrives as a flat row with a fixed schema, ready for databases or spreadsheets. |
| **No API key required** | Reads the public catalog pages directly. No registration, no OAuth, no rate-limit headaches. |
| **Domain filtering built in** | Query breaches by domain without scraping the whole catalog and filtering afterward. |
| **Flexible output formats** | Export your dataset to CSV, JSON, Excel, or XML from the Apify platform. |

### How it compares

No other Store actor targets Have I Been Pwned the same way, so the honest comparison is with the alternatives teams actually weigh.

| | Have I Been Pwned Breaches Catalog Scraper | Build it in-house | By hand |
|---|---|---|---|
| Setup | Run it now, zero config | Days of engineering | None, but hours per pull |
| When Have I Been Pwned changes | Maintained for you | You fix it | You re-learn the page |
| Proxies, retries, anti-bot | Built in | Your problem | Browser only |
| Output | Fixed JSON schema, CSV/Excel export | Whatever you build | Copy-paste |
| Cost | Pay per result | Engineering time | Analyst hours |

### Configure the run

Drive the Actor by choosing a mode: list all breaches, filter by a domain, or target a single breach by its exact name. The max items limit controls how many records reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

```json
{
  "maxItems": 10
}
```

A larger pull:

```json
{
  "maxItems": 200
}
```

### Pricing

Pay-per-result: **$0.004 per result** collected. You pay only for the results written to your dataset.

| Results collected | Approximate cost |
|---|---|
| 100 results | $0.40 |
| 1,000 results | $4.00 |
| 10,000 results | $40.00 |

New Apify accounts start with $5 in free credit.

### Free users

Free-plan runs return up to 10 results as a preview. [Upgrade your Apify plan](https://console.apify.com/sign-up?fpr=vmoqkp) to collect up to 1,000,000 results per run.

### Run it

1. [Create a free Apify account with $5 in credit](https://console.apify.com/sign-up?fpr=vmoqkp).
2. Open the [Have I Been Pwned Breaches Catalog Scraper](https://apify.com/parseforge/hibp-breaches-catalog-scraper?fpr=vmoqkp).
3. Set your inputs and any filters, then click **Start**.
4. Export the results as CSV, Excel, JSON, or XML from the **Dataset** tab.

Run it programmatically through the [Apify API](https://docs.apify.com/api/v2) (`run-sync-get-dataset-items`) or the [ApifyClient](https://docs.apify.com/api/client/js) for JavaScript and Python.

### Use with AI agents (MCP)

Give an AI agent live access to Have I Been Pwned through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

```bash
claude mcp add --transport http apify "https://mcp.apify.com?tools=parseforge/hibp-breaches-catalog-scraper"
```

Then prompt it in plain language to run the scraper and read back the results.

### Troubleshooting

**Why am I getting no results when I enter a domain?**

Check that the domain is spelled correctly and that you have selected 'Breaches by domain' as the mode. The domain should match the format used by Have I Been Pwned, for example 'adobe.com' without a protocol or path.

**The Actor returns fewer results than I expected.**

The Have I Been Pwned catalog only includes breaches that have been publicly disclosed and verified. A domain may have fewer associated breaches than you anticipate. Also check that your max items limit is set high enough.

**I get an error when fetching a single breach by name.**

Ensure the breach name matches exactly, including capitalization and spacing. Try the name as it appears in the HIBP catalog, such as 'Adobe' rather than 'adobe' or 'Adobe Systems'.

**The run takes a long time to complete.**

Fetching the full catalog with a high max items limit will take longer because the Actor reads each breach page individually. Reduce the max items limit if you only need a subset.

**Can I get the data classes for each breach?**

Yes. The Actor collects the data classes field for each breach, which lists the types of data exposed, such as 'Email addresses', 'Passwords', or 'Credit cards'.

### FAQ

| Question | Answer |
|---|---|
| What data does the Have I Been Pwned breach catalog contain? | The catalog lists publicly disclosed data breaches. Each entry includes the breach name, the date it occurred, the number of compromised accounts, and the types of data exposed, such as email addresses, passwords, or credit card numbers. |
| Do I need an API key to scrape the HIBP breach catalog? | No. This Actor reads the public web pages of the Have I Been Pwned breach catalog. You do not need to register an application or obtain an API key. |
| Can I filter breaches by a specific domain? | Yes. Set the mode to 'Breaches by domain' and enter the domain you want to query. The Actor returns only the breaches associated with that domain. |
| How do I get the details of a single breach? | Set the mode to 'Single breach by name' and enter the exact breach name as it appears on Have I Been Pwned, for example 'Adobe' or 'LinkedIn'. |
| What is the maximum number of breaches I can scrape? | You can set the maximum up to 1,000,000 breaches per run. The full catalog contains far fewer entries, so this limit will not restrict a complete scrape. |
| What export formats are supported? | You can export your results to CSV, JSON, Excel, or XML directly from the Apify dataset tab. |
| Does this Actor include the breached email addresses or passwords? | No. The Have I Been Pwned breach catalog describes each breach but does not expose the actual compromised records. This Actor collects the breach metadata only. |
| Can I schedule this Actor to run automatically? | Yes. Apify supports scheduled runs. You can set this Actor to run daily, weekly, or on any cron schedule to keep your breach dataset current. |
| Is this Actor affiliated with Have I Been Pwned? | No. This is an independent scraper that reads publicly available pages from the Have I Been Pwned website. It is not built or endorsed by Have I Been Pwned. |
| What happens if I enter an invalid breach name? | The Actor will attempt to fetch the breach page. If the name does not match any entry in the catalog, the run will complete with no results. |

### Related actors

Browse the full [ParseForge collection](https://apify.com/parseforge?fpr=vmoqkp) for more scrapers.

🆘 **Need help?** Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ **Disclaimer.** This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by Have I Been Pwned. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.

# Actor input Schema

## `mode` (type: `string`):

What to fetch from the Have I Been Pwned breach catalog. 'All breaches' lists every breach. 'By domain' returns only breaches tied to a domain. 'Single breach' fetches one breach by its name.

## `domain` (type: `string`):

Only used when Mode is 'Breaches by domain'. A domain to filter breaches by, for example 'adobe.com'. Leave empty for other modes.

## `breachName` (type: `string`):

Only used when Mode is 'Single breach by name'. The exact breach Name as used by Have I Been Pwned, for example 'Adobe' or 'LinkedIn'. Leave empty for other modes.

## `maxItems` (type: `integer`):

How many breaches to collect per run.

## Actor input object example

```json
{
  "mode": "all",
  "maxItems": 10
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxItems": 10
};

// Run the Actor and wait for it to finish
const run = await client.actor("parseforge/hibp-breaches-catalog-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "maxItems": 10 }

# Run the Actor and wait for it to finish
run = client.actor("parseforge/hibp-breaches-catalog-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxItems": 10
}' |
apify call parseforge/hibp-breaches-catalog-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,parseforge/hibp-breaches-catalog-scraper"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/c9xF3ntWcLS1a8IF7/builds/QrJIw14VlJohtwx2Y/openapi.json