Data Breach Index
Query the Breaches Behind Your Exposed Addresses.
Employee Email Breach Monitoring tells you which addresses leaked. The Data Breach Index reads that data from the other side: the breaches themselves.
Each breach is a record with its date, a description, the data types it exposed, how many accounts it holds in total and how many of them are yours.
Request
GET /
Response · 200 OK
Example Marketmarket.example
-
breach_date2026-04-11
-
added_date2026-04-19
-
data_typesEmail addresses Names Passwords Phone numbers
-
total_breached_account_count820,000
-
breached_account_count14 · acme.example
-
Flags
is_verifiedtrueis_fabricatedfalseis_spam_listfalseis_malwarefalseis_sensitivefalseis_retiredfalse
Ways in: by breach · by account · by domain · by recency
What Each Breach Record Holds.
All breach records share one set of fields, so two breaches can be compared line by line before anyone decides which one matters.
| Name | name, title · The breach as it is commonly known |
|---|---|
| Source | domain · The domain of the service that was breached |
| Breach date | breach_ · When the compromise happened |
| Added date | added_, modified_ · When the breach entered the index, and when its record last changed |
| Description | description · What happened and what was exposed, in prose |
| Data types | data_ · The categories exposed, such as email addresses, names, phone numbers or passwords |
| Total accounts | total_ · How many accounts the breach holds in total |
| Your accounts | breached_, breached_ · How many of those accounts are yours, and on which of your domains |
| Flags | is_, is_ and the other is_ fields · Verified, fabricated, sensitive, retired, spam list, malware |
Field names as returned by the Email Breach List and Email Breach Detail endpoints.
Each Way In Leads to One Set of Records.
Investigations rarely start in the same place twice. Pick the entry point that fits the question.
By breach
One Breach, in Full
Open a breach and read its record: when, what, how big, and how many of your accounts it holds.
By account
One Address, Every Breach
Start from an address and list the breaches it appears in, with per-account statistics.
By domain
Counts per Domain
Breached accounts per domain, for organizations that run many brands or subsidiaries.
By recency
The Latest Breaches
The most recent breaches to include your addresses, the starting point for a weekly review.
Narrow the List With Query Filters.
Filters go on the query string. Verified breaches since January, newest first, is one request. Swap in added_ with last Monday’s date and it becomes the weekly review of what entered the index.
| Parameter | Type | Description | |
|---|---|---|---|
title_ | string | Optional | Part of the breach title. domain_ does the same for the breached service’s domain. |
breach_ | date-time | Optional | Breaches that happened after this date. breach_ sets the other bound. |
added_ | date-time | Optional | Breaches added to the index after this date. |
data_ | string | Optional | Breaches that exposed any of the given data types. |
is_ | boolean | Optional | A breach flag. is_, is_, is_, is_ and is_ work the same way. |
ordering | string | Optional | The field to sort by. Prefix - for descending. |
Request
curl "https://api.deepinfo.com/v1/cti/email-breaches/breaches?is_verified=true&breach_date__gt=2026-01-01&ordering=-breach_date" \
-H "apikey: YOUR_API_KEY"import requests
r = requests.get(
"https://api.deepinfo.com/v1/cti/email-breaches/breaches",
params={
"is_verified": "true",
"breach_date__gt": "2026-01-01",
"ordering": "-breach_date",
},
headers={"apikey": "YOUR_API_KEY"},
)
for b in r.json()["results"]:
print(b["name"], b["breach_date"], b["breached_account_count"], b["data_types"])Response
{
"page": 1,
"page_size": 25,
"result_count": 3,
"results": [
{
"id": "ExampleMarket",
"name": "ExampleMarket",
"title": "Example Market",
"domain": "market.example",
"breach_date": "2026-04-11T00:00:00Z",
"added_date": "2026-04-19T08:12:05Z",
"modified_date": "2026-04-19T08:12:05Z",
"total_breached_account_count": 820000,
"data_types": ["Email addresses", "Names", "Passwords", "Phone numbers"],
"is_verified": true,
"is_fabricated": false,
"is_sensitive": false,
"is_retired": false,
"is_spam_list": false,
"is_malware": false,
"breached_account_count": 14,
"breached_domains": [{ "domain": "acme.example" }]
},
"…"
]
}Workflows That Start From a Breach.
Incident Scoping
When a breach makes the news, check whether it holds your addresses, how many, and which data types went with them.
Credential Exposure
Tie each exposed account to the breach it came from, and weigh it by what that breach exposed.
Weighing a Breach
Check the verified, fabricated and spam list flags first. A fabricated breach or a spam list calls for a different response than a verified compromise.
Reporting
The CTI Email Breach Summary is a PDF report, on demand or on a daily, weekly or monthly schedule.
Query This Data Through the API
Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API.
Questions About Data Breach Index
Does the index cover every breach on the internet?
The breaches your team queries are the ones that contain addresses on your organization’s domains. Each record still describes the whole breach, including its total account count, not only your share.
How is it different from Employee Email Breach Monitoring?
Same data, other direction. Monitoring starts from people and addresses; the index starts from breaches. Most investigations move between the two.
What do the flags mean?
They describe the breach itself: whether it is verified, whether it appears fabricated, whether it is a spam list, whether it came from malware, whether it is sensitive and whether it has been retired. Use them to weigh a breach before acting on it.
Can we be told when a new breach includes our addresses?
Yes. A notification rule on new_ emails the team members you choose, instantly or as an hourly to monthly digest.
See Which Breaches Hold Your Addresses.
Book a walk-through and we’ll query the index for your domains.