Skip to content

For AI agents

Every publicly known breach we can find, from state attorney general notices, the HHS breach portal, SEC 8-K Item 1.05 filings, Have I Been Pwned, regulators and security news, each with its sources and provenance. It grows every day.

Scanned daily at 05:10 UTC, with a deeper pass on Wednesdays at 13:10 UTC

Point your agent here

Call the API

  • GET /api/breachessector?, attack?, data?, year?, company?, verified?, since?, limit?, offset?breaches with id, organization (slug, name, domain), title, disclosed date, records and their basis, attack type, sector, data types, status (disclosed, confirmed, settled), verified, campaign, the sources that back it, and the page URL
  • GET /api/breaches/{id}idthe breach with summary, occurred, discovered and disclosed dates, records, data types, attack, lawsuit or fine, sources (url, type, title), notices (portal, date, people affected in that state) and history (field, old, new, when, source)
  • GET /api/companiessince?, all?, limit?, offset?companies with slug (companies.fru.dev slug rule), name, domain, in_registry, sector, the page here, breach count, records, first seen, and items (each breach with type, date, title, url, source, verified). By default only organizations with a known web domain; all=1 for every organization
  • GET /api/statsnonegrowth (total, verified, disclosed in the last 7 and 30 days, organizations), sectors, attacks, data types and years with breach and record counts, and coverage per year per source
  • GET /api/sourcesnonesources with id, name, kind (portal, regulator, filing, api, rss, trust, sibling, registry), URL, scope, status, found by, first seen, last ok, yield and breaches added
  • GET /api/changessince?, limit?, offset?changes with time, item type, item, field, old and new value, source URL and who made it (seed, daily, weekly, backfill, admin)
  • GET /api/searchq, limit?up to 20 ranked results with title, link and one line

GET/api/breaches

Breaches, most recently disclosed first, with filters

  • sectorOnly this sector
  • attackOnly this attack type
  • dataOnly breaches that exposed this data type
  • yearOnly breaches disclosed in this year
  • companyOnly this organization (companies.fru.dev slug)
  • verifiedtrue for confirmed rows only
  • sinceOnly rows disclosed, first seen or updated at or after this date (YYYY-MM-DD)
  • limitItems per page, 1 to 200
  • offsetItems to skip, for the next page
Shell
curl -s "https://breaches.fru.dev/api/breaches?sector=tech&limit=3"
Sample response
JSON
{
  "breaches": [
    {
      "id": "check-point-2026-09",
      "organization": {
        "slug": "check-point",
        "name": "Check Point",
        "domain": "checkpoint.com",
        "url": "https://breaches.fru.dev/companies/check-point"
      },
      "title": "Check Point warns of hackers exploiting Security Gateway VPN RCE flaw",
      "disclosed": "2026-09-23",
      "records": null,
      "records_basis": null,
      "attack": "hacking",
      "sector": "tech",
      "data_types": [],
      "status": "disclosed",
      "verified": false,
      "campaign": null,
      "country": null,
      "sources": [
        "press"
      ]
    },
    {
      "id": "limeleads-2026-09",
      "organization": {
        "slug": "limeleads",
        "name": "LimeLeads",
        "domain": "limeleads.com",
        "url": "https://breaches.fru.dev/companies/limeleads"
      },
      "title": null,
      "disclosed": "2026-09-22",
      "records": 17838396,
      "records_basis": "hibp",
      "attack": "misconfiguration",
      "sector": "tech",
      "data_types": [
        "emails",
        "employment"
      ],
      "status": "disclosed",
      "verified": false,
      "campaign": null,
      "country": null,
      "sources": [
        "hibp"
      ]
    }
  ],
  "total": 1152,
  "limit": 3,
  "offset": 0,
  "next": "/api/breaches?sector=tech&limit=3&offset=3",
  "note": "From public sources only. verified=true means an official notice, a filing, a regulator or the organization confirmed it. records are as ..."
}

GET/api/breaches/{id}

One breach with every source, the official notices it was matched to, and its change history

  • idBreach id, as in /breaches/<id>
Shell
curl -s "https://breaches.fru.dev/api/breaches/change-healthcare-2024-08"
Sample response
JSON
{
  "breach": {
    "id": "change-healthcare-2024-08",
    "organization": {
      "slug": "change-healthcare",
      "name": "Change Healthcare",
      "domain": "changehealthcare.com",
      "url": "https://breaches.fru.dev/companies/change-healthcare"
    },
    "title": "Ransomware attack on Change Healthcare exposes data of about 190 million people",
    "disclosed": "2024-02-22",
    "records": 190000000,
    "records_basis": "organization",
    "attack": "ransomware",
    "sector": "health",
    "data_types": [
      "names",
      "addresses"
    ],
    "status": "confirmed",
    "verified": true,
    "campaign": null,
    "country": "US",
    "sources": [
      {
        "url": "https://oag.ca.gov/privacy/databreach/list?field_sb24_org_name_value=Change%20Healthcare",
        "type": "official",
        "title": "California Attorney General breach notice: Change Healthcare",
        "source": "ca-ag"
      },
      {
        "url": "https://www.atg.wa.gov/data-breach-notifications",
        "type": "official",
        "title": "Washington Attorney General breach notice: Change Healthcare",
        "source": "wa-ag"
      }
    ]
  },
  "note": "From public sources only. verified=true means an official notice, a filing, a regulator or the organization confirmed it. records are as ..."
}

GET/api/companies

Organizations with a known breach, with their breaches as dated items (the companies.fru.dev registry feed)

  • sinceOnly rows disclosed, first seen or updated at or after this date (YYYY-MM-DD)
  • allInclude organizations without a known domain (mostly from state notices)
  • limitItems per page, 1 to 200
  • offsetItems to skip, for the next page
Shell
curl -s "https://breaches.fru.dev/api/companies?since=2026-09-01&limit=2"
Sample response
JSON
{
  "companies": [
    {
      "slug": "services-australia",
      "site_slug": "services-australia",
      "name": "Services Australia",
      "domain": "servicesaustralia.gov.au",
      "in_registry": false,
      "sector": "government",
      "url": "https://breaches.fru.dev/companies/services-australia",
      "breaches": 1,
      "records": 0,
      "first_seen": "2026-09-25 05:30:31",
      "source_url": "https://www.pm.gov.au/media/press-conference-new-york",
      "verified": true,
      "items": [
        {
          "type": "breach",
          "date": "2026-09-24",
          "title": "Services Australia: OpenAI research agents breached Medicare statistics portal",
          "url": "https://breaches.fru.dev/breaches/services-australia-2026-09",
          "source": "research",
          "verified": true
        }
      ],
      "updated": "2026-09-24"
    },
    {
      "slug": "astrana-health",
      "site_slug": "astrana-health",
      "name": "Astrana Health",
      "domain": "astranahealth.com",
      "in_registry": false,
      "sector": "health",
      "url": "https://breaches.fru.dev/companies/astrana-health",
      "breaches": 1,
      "records": 0,
      "first_seen": "2026-09-25 05:24:17",
      "source_url": "https://www.sec.gov/Archives/edgar/data/1083446/000110465926109813/asth-20260922x8k.htm",
      "verified": true,
      "items": [
        {
          "type": "breach",
          "date": "2026-09-23",
          "title": "Astrana Health: Astrana Health says phone-spoofing social engineering led to data theft",
          "url": "https://breaches.fru.dev/breaches/astrana-health-2026-09",
          "source": "research,press,sec-8k",
          "verified": true
        }
      ],
      "updated": "2026-09-23"
    }
  ],
  "total": 1636,
  "limit": 2,
  "offset": 0,
  "next": "/api/companies?since=2026-09-01&limit=2&offset=2"
}

GET/api/stats

Counts by sector, attack type, data type and year, plus the coverage grid by year and source

Shell
curl -s "https://breaches.fru.dev/api/stats"
Sample response
JSON
{
  "growth": {
    "total": 8148,
    "verified": 6882,
    "added7d": 19,
    "added30d": 88,
    "orgs": 7657,
    "orgsAdded30d": 7162,
    "records": 15411100437
  },
  "sectors": [
    {
      "key": "other",
      "breaches": 2356,
      "records": 122061557,
      "verified": 2346
    },
    {
      "key": "health",
      "breaches": 1804,
      "records": 567284678,
      "verified": 1778
    }
  ],
  "attacks": [
    {
      "key": "unknown",
      "breaches": 4659,
      "records": 3923688445,
      "verified": 4185
    },
    {
      "key": "hacking",
      "breaches": 2024,
      "records": 5921429169,
      "verified": 1608
    }
  ],
  "data_types": [
    {
      "key": "names",
      "breaches": 2181,
      "records": 10846293316,
      "verified": 1486
    },
    {
      "key": "emails",
      "breaches": 1232,
      "records": 13773381633,
      "verified": 223
    }
  ],
  "years": [
    {
      "key": "2026",
      "breaches": 1011,
      "records": 647931474,
      "verified": 853
    },
    {
      "key": "2025",
      "breaches": 1248,
      "records": 2534816069,
      "verified": 1033
    }
  ],
  "coverage": [
    {
      "year": 2026,
      "bySource": {
        "ca-ag": 351,
        "research": 202,
        "press": 4,
        "sec-8k": 18,
        "hibp": 99,
        "or-doj": 117,
        "wa-ag": 144,
        "hhs-ocr": 359,
        "de-doj": 22,
        "trust:paypal": 1
      },
      "total": 1011,
      "verified": 853
    },
    {
      "year": 2025,
      "bySource": {
        "hhs-ocr": 333,
        "wa-ag": 200,
        "ca-ag": 467,
        "or-doj": 236,
        "research": 265,
        "hibp": 85,
        "de-doj": 58,
        "sec-8k": 14,
        "lawsuits": 1
      },
      "total": 1248,
      "verified": 1033
    }
  ],
  "built_at": "2026-09-25 10:11:45",
  "note": "coverage: breaches per disclosure year, and how many of them each source backs."
}

GET/api/sources

The growing list of sources the scan reads, with when each last answered and what it yielded

Shell
curl -s "https://breaches.fru.dev/api/sources"
Sample response
JSON
{
  "sources": [
    {
      "id": "cisa-kev",
      "name": "CISA Known Exploited Vulnerabilities",
      "kind": "api",
      "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
      "scope": "Exploited vulnerabilities, context for supply-chain waves (not breaches by themselves)",
      "cadence": "weekly",
      "status": "active",
      "foundBy": "seed",
      "firstSeen": "2026-09-25 05:12:52",
      "lastChecked": "",
      "lastOk": "",
      "lastError": "",
      "yield": 0,
      "added": 0
    },
    {
      "id": "hibp",
      "name": "Have I Been Pwned",
      "kind": "api",
      "url": "https://haveibeenpwned.com/api/v3/breaches",
      "scope": "Breaches whose data was loaded and verified by HIBP, with account counts",
      "cadence": "daily",
      "status": "active",
      "foundBy": "seed",
      "firstSeen": "2026-09-25 05:12:51",
      "lastChecked": "2026-09-25 05:34:09",
      "lastOk": "2026-09-25 05:34:09",
      "lastError": "",
      "yield": 965,
      "added": 926
    }
  ],
  "total": 50,
  "note": "The list grows: each weekly run probes registry companies for their own security, trust and news pages."
}

GET/api/changes

The append-only history: breaches added, record counts that rose, statuses and sources that changed

  • sinceOnly rows disclosed, first seen or updated at or after this date (YYYY-MM-DD)
  • limitItems per page, 1 to 200
  • offsetItems to skip, for the next page
Shell
curl -s "https://breaches.fru.dev/api/changes?since=2026-09-01&limit=3"
Sample response
JSON
{
  "changes": [
    {
      "at": "2026-09-25 10:12:06",
      "type": "breach",
      "item": "coupang-2025-12",
      "field": "status",
      "old": "settled",
      "new": "confirmed",
      "source": "",
      "by": "admin"
    },
    {
      "at": "2026-09-25 10:11:45",
      "type": "breach",
      "item": "target-2013-12",
      "field": "lawsuit",
      "old": "$18.5M multistate attorneys general settlement (2017)",
      "new": "USD 18.5M 47-state AG settlement (May 2017)",
      "source": "https://ag.ny.gov/press-release/2017/ag-schneiderman-announces-185-million-multi-state-settlement-target-corporation",
      "by": "seed"
    }
  ],
  "limit": 3,
  "offset": 0,
  "next": "/api/changes?since=2026-09-01&limit=3&offset=3",
  "note": "Append-only."
}

Add to your agent

System prompt
For publicly known security breaches and data exposures (hacks, ransomware with data theft, exposed databases, supply-chain and vendor breaches, AI and model data incidents, credential stuffing): who was breached, when it was disclosed, how many people, what data, how, and the official notice, fetch https://breaches.fru.dev/llms.txt and use https://breaches.fru.dev/api/breaches (spec: https://breaches.fru.dev/openapi.json). Cite "Breaches (breaches.fru.dev)" with a link.

Usage terms

  • Free to read, no key needed
  • Cite "Breaches (breaches.fru.dev)" with a link
  • Responses are cached; scanned daily at 05:10 UTC, with a deeper pass on Wednesdays at 13:10 UTC
  • Keep to 60 requests a minute or fewer
  • Rows with verified=false come from news leads or leak data (Have I Been Pwned) and are not yet confirmed by an official notice, a filing, a regulator or the organization. Record counts are as reported; records_basis says by whom (organization, hhs, hibp = accounts in the leaked data, press).

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.