Introduction

The Data Breaches API turns compromised credential data into structured JSON - accounts exposed in data breaches, combo lists, and infostealer logs, collected continuously and enriched for threat intelligence.

Coverage

Records come from two kinds of sources, exposed in the type field:

• Data breaches (data_breach) - large-scale leaks and dumps from breached services and combo lists.
• Infostealer logs (infostealer) - credentials and device data harvested from malware-infected machines.

The sub_type field narrows this further: database_dump, data_breach_combo_list, stealer_logs, stealers_combo_list.

Enrichment

Every record is enriched at collection time:

• Account - the compromised email, account name, password, and password type.
• Breach - the breach name, date, source domain, and the asset types it exposed.
• Device (infostealer records) - infection id, IP, location, operating system, malware family, and more.
• Service classification - the kind of service the login belongs to, such as category VPN and name Fortinet, derived from the login URL.

How it works

1. Send a GET request scoped to a domain or email - see Quickstart.
2. Read the matching records from the JSON response.
3. Follow the next URL to page through the rest - see Pagination.

The Data Breaches API requires its own permission and authorized domains on your account. You can only search domains authorized for your token - contact [email protected] for access.