# Data Breach Index URL: https://www.deepinfo.com/platform/cti/data-breach-index/ ## Query the Breaches Behind Your Exposed Addresses. Employee Email Breach Monitoring tells you which addresses leaked. The Data Breach Index reads that data from the other side: the breaches themselves. Each breach is a record with its date, a description, the data types it exposed, how many accounts it holds in total and how many of them are yours. [Request demo](https://www.deepinfo.com/request-demo/) · [CTI API reference](https://docs.deepinfo.com/reference/cti/) ### What Each Breach Record Holds. All breach records share one set of fields, so two breaches can be compared line by line before anyone decides which one matters. - **Name**: `name`, `title` · The breach as it is commonly known - **Source**: `domain` · The domain of the service that was breached - **Breach date**: `breach_date` · When the compromise happened - **Added date**: `added_date`, `modified_date` · When the breach entered the index, and when its record last changed - **Description**: `description` · What happened and what was exposed, in prose - **Data types**: `data_types` · The categories exposed, such as email addresses, names, phone numbers or passwords - **Total accounts**: `total_breached_account_count` · How many accounts the breach holds in total - **Your accounts**: `breached_account_count`, `breached_domains` · How many of those accounts are yours, and on which of your domains - **Flags**: `is_verified`, `is_fabricated` and the other `is_` fields · Verified, fabricated, sensitive, retired, spam list, malware Field names as returned by the [Email Breach List](https://docs.deepinfo.com/reference/cti/email-breach-list/) and [Email Breach Detail](https://docs.deepinfo.com/reference/cti/email-breach-detail/) endpoints. ### Each Way In Leads to One Set of Records. Investigations rarely start in the same place twice. Pick the entry point that fits the question. By breach #### One Breach, in Full Open a breach and read its record: when, what, how big, and how many of your accounts it holds. By account #### One Address, Every Breach Start from an address and list the breaches it appears in, with per-account statistics. By domain #### Counts per Domain Breached accounts per domain, for organizations that run many brands or subsidiaries. By recency #### The Latest Breaches The most recent breaches to include your addresses, the starting point for a weekly review. ### Narrow the List With Query Filters. Filters go on the query string. Verified breaches since January, newest first, is one request. Swap in `added_date__gt` with last Monday’s date and it becomes the weekly review of what entered the index. GET `https://api.deepinfo.com/v1/cti/email-breaches/breaches` [Reference](https://docs.deepinfo.com/reference/cti/email-breach-list/) | Parameter | Type | | Description | | --- | --- | --- | --- | | `title__contains` | string | Optional | Part of the breach title. `domain__contains` does the same for the breached service’s domain. | | `breach_date__gt` | date-time | Optional | Breaches that happened after this date. `breach_date__lt` sets the other bound. | | `added_date__gt` | date-time | Optional | Breaches added to the index after this date. | | `data_types__in` | string | Optional | Breaches that exposed any of the given data types. | | `is_verified` | boolean | Optional | A breach flag. `is_fabricated`, `is_sensitive`, `is_retired`, `is_spam_list` and `is_malware` work the same way. | | `ordering` | string | Optional | The field to sort by. Prefix `-` for descending. | Request curl: ```bash curl "https://api.deepinfo.com/v1/cti/email-breaches/breaches?is_verified=true&breach_date__gt=2026-01-01&ordering=-breach_date" \ -H "apikey: YOUR_API_KEY" ``` Python: ```python import requests r = requests.get( "https://api.deepinfo.com/v1/cti/email-breaches/breaches", params={ "is_verified": "true", "breach_date__gt": "2026-01-01", "ordering": "-breach_date", }, headers={"apikey": "YOUR_API_KEY"}, ) for b in r.json()["results"]: print(b["name"], b["breach_date"], b["breached_account_count"], b["data_types"]) ``` Response 200 OK · application/json ```json { "page": 1, "page_size": 25, "result_count": 3, "results": [ { "id": "ExampleMarket", "name": "ExampleMarket", "title": "Example Market", "domain": "market.example", "breach_date": "2026-04-11T00:00:00Z", "added_date": "2026-04-19T08:12:05Z", "modified_date": "2026-04-19T08:12:05Z", "total_breached_account_count": 820000, "data_types": ["Email addresses", "Names", "Passwords", "Phone numbers"], "is_verified": true, "is_fabricated": false, "is_sensitive": false, "is_retired": false, "is_spam_list": false, "is_malware": false, "breached_account_count": 14, "breached_domains": [{ "domain": "acme.example" }] }, "…" ] } ``` ### Workflows That Start From a Breach. #### [Incident Scoping](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) When a breach makes the news, check whether it holds your addresses, how many, and which data types went with them. #### [Credential Exposure](https://www.deepinfo.com/solutions/use-cases/credential-exposure-management/) Tie each exposed account to the breach it came from, and weigh it by what that breach exposed. #### [Weighing a Breach](https://www.deepinfo.com/solutions/use-cases/data-leak-detection/) Check the verified, fabricated and spam list flags first. A fabricated breach or a spam list calls for a different response than a verified compromise. #### Reporting The CTI Email Breach Summary is a PDF report, on demand or on a daily, weekly or monthly schedule. ### Read the Data From Other Directions. - [Employee Email Breach Monitoring](https://www.deepinfo.com/platform/cti/employee-email-breach-monitoring/) (CTI): Start from people and addresses instead of breaches. - [Compromised Client Credential Monitoring](https://www.deepinfo.com/platform/cti/compromised-client-credential-monitoring/) (CTI): Your customers’ logins to your services, found in leaked data. - [Executive Threat Monitoring](https://www.deepinfo.com/platform/cti/executive-threat-monitoring/) (CTI): Breaches filtered to the people you flag. ### Query This Data Through the API Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API. - [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/) - [Vulnerability Detail API](https://www.deepinfo.com/data-api/apis/vulnerability-detail/) - [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/) - [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/) ### Questions About Data Breach Index **Does the index cover every breach on the internet?** The breaches your team queries are the ones that contain addresses on your organization’s domains. Each record still describes the whole breach, including its total account count, not only your share. **How is it different from Employee Email Breach Monitoring?** Same data, other direction. Monitoring starts from people and addresses; the index starts from breaches. Most investigations move between the two. **What do the flags mean?** They describe the breach itself: whether it is verified, whether it appears fabricated, whether it is a spam list, whether it came from malware, whether it is sensitive and whether it has been retired. Use them to weigh a breach before acting on it. **Can we be told when a new breach includes our addresses?** Yes. A notification rule on `new_email_breach_detected` emails the team members you choose, instantly or as an hourly to monthly digest. ### See Which Breaches Hold Your Addresses. Book a walk-through and we’ll query the index for your domains. [Request demo](https://www.deepinfo.com/request-demo/)