Have I Been Pwned API: Search breaches
Finds recorded data breaches whose title or website domain matches a company or website name, newest first.
Unofficial. Not affiliated with or endorsed by Have I Been Pwned.
Inputs
Values from the run on Oct 23, 2026, shown under Output.
- Company, required
company Company or website to search for, for example Adobe or adobe.com.
Adobe
- Max Results optional
max_results Most breaches to return, for example 20 (maximum 100).
20 (default)
Whole number from 1 to 100.
Input as JSON
{ "company": "Adobe"}Output
{ "breaches": [ { "website": "adobe.com", "verified": "yes", "date_added": "2013-12-04", "breach_date": "2013-10-04", "breach_name": "Adobe", "description": "In October 2013, 153 million Adobe accounts were breached with each containing an internal ID, username, email, encrypted password and a password hint in plain text. The password cryptography was poorly done and many were quickly resolved back to plain text. The unencrypted hints also disclosed much…", "data_exposed": "Email addresses, Password hints, Passwords, Usernames", "breach_page_link": "https://haveibeenpwned.com/Breach/Adobe" , "accounts_affected": 152445165 } ]}Code
curl https://api.fous.com/v1/runs \ -H "Authorization: Bearer $FOUS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"method":"haveibeenpwned.com/search_breaches","input":{"company":"Adobe"}}' # Save as fous.py, then run: python3 fous.pyimport json, os, timefrom urllib.error import HTTPErrorfrom urllib.request import Request, urlopenAPI = "https://api.fous.com/v1/runs" KEY = os.environ["FOUS_API_KEY"]HEADERS = { "Authorization": f"Bearer {KEY}", "Content-Type": "application/json" ,}def call(url, body=None): data = json.dumps(body).encode() if body else None request = Request(url, data, HEADERS) try: with urlopen(request, timeout=120) as r: return r.status, json.load(r) except HTTPError as error: message = json.load(error)["error"]["message"] raise RuntimeError(message) from errorstatus, run = call(API, { "method": "haveibeenpwned.com/search_breaches" , "input": { "company": "Adobe" }})# 202: still going after 30 s. Ask again until it ends.while status == 202: time.sleep(2) status, run = call(f"{API}/{run['id']}")print(json.dumps(run["data"], indent=2))// Save as fous.mjs, then run: node fous.mjsconst api = "https://api.fous.com/v1/runs" ;const headers = { Authorization: `Bearer ${process.env.FOUS_API_KEY}`, "Content-Type": "application/json" ,};let response = await fetch(api, { method: "POST", headers, body: JSON.stringify({ "method": "haveibeenpwned.com/search_breaches" , "input": { "company": "Adobe" } }), signal: AbortSignal.timeout(120_000),});let run = await response.json();// 202: still going after 30 s. Ask again until it ends.while (response.status === 202) { await new Promise((done) => setTimeout(done, 2_000)); response = await fetch(`${api}/${run.id}`, { headers }); run = await response.json();}if (!response.ok) throw new Error(run.error.message);console.log(run.data);# Connect your agent to Fous once, over MCP (Streamable HTTP):# https://api.fous.com/mcp# Set FOUS_API_KEY first: create a key at https://app.fous.com/keys.# Claude Codeclaude mcp add \ --scope user \ --transport http fous https://api.fous.com/mcp \ --header "Authorization: Bearer ${FOUS_API_KEY:?Set FOUS_API_KEY to your Fous API key}"# Codexcodex mcp add fous \ --url https://api.fous.com/mcp \ --bearer-token-env-var FOUS_API_KEY# Cursor, VS Code, Windsurf, Cline and morenpx -y add-mcp https://api.fous.com/mcp -g -n fous \ --header "Authorization: Bearer ${FOUS_API_KEY:?Set FOUS_API_KEY to your Fous API key}"# Then ask your agent:# "Use Fous to run haveibeenpwned.com/search_breaches# with {"company":"Adobe"}"Over HTTP, the answer’s data holds the output. A run still going after 30 seconds answers 202 with its id: ask GET /v1/runs/{id} until it ends.
Schema
Input schema
{ "type": "object", "required": [ "company" ], "properties": { "company": { "type": "string", "minLength": 1, "description": "Company or website to search for, for example Adobe or adobe.com." }, "max_results": { "type": "integer", "default": 20, "maximum": 100, "minimum": 1, "description": "Most breaches to return, for example 20 (maximum 100)." } }}Output schema
{ "type": "object", "required": [ "breaches" ], "properties": { "breaches": { "type": "array", "items": { "type": "object", "required": [ "breach_name", "website", "breach_date", "date_added", "accounts_affected", "data_exposed", "verified", "description", "breach_page_link" ], "properties": { "website": { "type": [ "string", "null" ], "description": "Affected website domain." }, "verified": { "enum": [ "yes", "no" ], "type": "string", "description": "Whether the breach was verified." }, "date_added": { "type": [ "string", "null" ], "format": "date", "description": "Date the breach was added." }, "breach_date": { "type": [ "string", "null" ], "format": "date", "description": "Date of the breach." }, "breach_name": { "type": "string", "description": "Name of the breach." }, "description": { "type": "string", "description": "Plain-text summary of the breach." }, "data_exposed": { "type": "string", "description": "Kinds of personal data exposed." }, "breach_page_link": { "type": "string", "format": "uri", "description": "Breach page on Have I Been Pwned." }, "accounts_affected": { "type": [ "integer", "null" ], "description": "Number of accounts affected." } }, "additionalProperties": false }, "description": "Matching breaches, newest first." } }, "additionalProperties": false}- Price
- 1 credit per completed run (1¢ with pay as you go); failed runs are free.
- Method
haveibeenpwned.com/search_breaches- Returns
- breach name, website, breach date, date added, accounts affected, data exposed, verified flag, description, breach page link
Use it from your agent
Give your agent this line. It reads SKILL.md, gets a Fous API key and connects the Fous MCP server. Its run then takes the method haveibeenpwned.com/search_breaches with the inputs above.
Ask your agent
- Which data breaches have been recorded for Adobe, newest first? Show me up to 10 with dates and accounts affected.
- Find breaches tied to linkedin.com and list the breach name, breach date, and what data was exposed.
- I need a list of recorded breaches matching the company Dropbox, including whether each one is verified and a link to its page.
- Pull up the 25 most recent breaches associated with the domain yahoo.com so I can see how many accounts were affected.
- Has Canva had any data breaches on record? Give me the newest ones with their descriptions.
See more
Finds known vulnerabilities (CVEs) in the NVD that match a product or vendor name, newest first. Each CVE is flagged when it is in CISA's known exploited catalog.
nvd.nist.gov/search_vulnerabilitiesFinds companies on Trustpilot by name or what they do, with TrustScore, review count, categories, location, logo and links. A preferred country moves companies listed in that country to the front.
trustpilot.com/search_companiesSearches the UK Companies House register by company name and returns each company's status, type, incorporation date and registered office address, in result order.
find-and-update.company-information.service.gov.uk/search_companiesFinds U.S. consumer product recalls matching a product type or brand, newest first, with hazards, remedies, incidents, sale details and photos when published.
cpsc.gov/search_recallsSearches the Y Combinator company directory by keyword, industry, batch, location, hiring and status, returning companies in directory order.
ycombinator.com/search_companiesReads recent public Trustpilot reviews for a company by name, website or Trustpilot link, in every language, with its TrustScore, ratings, reviewer details and company replies. Reviews follow the chosen sort (most recent or most relevant) and star filters, starting from a chosen results page.
trustpilot.com/get_company_reviewsLists a UK company's Companies House filings, newest first, with date, form code, type, description, page count and PDF link. Finds the company by name, company number or Companies House link; a category picks accounts, confirmation statements, officers, address, capital, charges or incorporation filings.
find-and-update.company-information.service.gov.uk/list_filing_historyLists US IPOs from a chosen year, newest first. Each IPO comes with its IPO price, current price and return since IPO. Coverage begins in 2019.
stockanalysis.com/list_recent_ipos