HIBP Breach Monitor

Overview

The HIBP Breach Monitor watches Have I Been Pwned for new data breaches and turns the listing into a ranked report instead of a page you have to check by hand. It crawls the recent breaches list, fetches each breach detail page, then dedupes and classifies every entry by severity (critical, high, medium, or low) into a JSONL file with a summary rollup. Use it to keep an exposure register current, to brief a team on the breaches that matter this week, or as a feed for an alerting step. You can inspect the crawl and the classifier in visual workflows before you schedule it.

Pipeline

1. Seed Targets (seed, script) starts from the recent-breaches listing URL.
2. Crawl List Page → Breach URLs (crawl, script) collects each breach detail link.
3. Fetch Breach Detail Pages (fetch, script) retrieves the public detail for those URLs.
4. Dedupe & Classify → JSONL (sink, script) writes one ranked row per breach plus a severity rollup.

Inputs

• A starting URL on Have I Been Pwned (the recent breaches page by default).
• Optional: a severity threshold to keep (for example, only critical and high).

Outputs

• A JSONL file with one row per breach, including its name, detail URL, and severity class.
• A summary rollup that counts breaches by severity.

Sample output

The artifacts below are illustrative. They show the report shape, not a completed run.

breaches.jsonl

summary.json

{"critical":0,"high":1,"medium":1,"low":0}

FAQ

Where does the severity classification come from?

The workflow assigns severity from the breach detail page (records exposed, data types, and recency) using a fixed rule set, so the ranking is reproducible across runs.

Does it check whether a specific email was breached?

No. It monitors the public list of recent breaches, not the per-email lookup, which requires an API key and a different endpoint.

How often should I run it?

A daily run is enough to catch new breaches within a day of their publication on Have I Been Pwned.

Can I send an alert when a critical breach lands?

Yes. Point the JSONL output at a downstream step that filters for critical and posts to your alert channel.

Related workflows

• arXiv Paper Summarizer - turn a trending research paper into a structured summary.
• GitHub Trending Scraper - track which repos are climbing the GitHub Trending page.
• Scan GitHub for Leaked Secrets - scan an org's commit history for leaked credentials.