{ "openapi": "3.1.0", "info": { "title": "Breaches API", "version": "1.0.0", "summary": "Every publicly known breach we can find, from state attorney general notices, the HHS breach portal and its archive, SEC 8-K Item 1.05 and 8.01 filings, Have I Been Pwned, regulators (HHS, UK ICO) and security news, each with its sources and provenance. It grows every day", "description": "Every publicly known breach we can find, from state attorney general notices, the HHS breach portal and its archive, SEC 8-K Item 1.05 and 8.01 filings, Have I Been Pwned, regulators (HHS, UK ICO) and security news, each with its sources and provenance. It grows every day. Scanned daily at 05:10 UTC, with a deeper pass on Wednesdays at 13:10 UTC. Free to read; please cite \"Breaches (breaches.fru.dev)\" with a link. Responses are cached at the edge; keep to about 60 requests a minute. Guide: https://breaches.fru.dev/agents", "contact": { "name": "fru.dev", "url": "https://fru.dev", "email": "fru.dev3@gmail.com" } }, "externalDocs": { "description": "For AI agents", "url": "https://breaches.fru.dev/agents" }, "servers": [ { "url": "https://breaches.fru.dev" } ], "paths": { "/api/breaches": { "get": { "operationId": "list_breaches", "summary": "Breaches, most recently disclosed first, with filters", "description": "Breaches, most recently disclosed first, with filters. Returns breaches with id, organization (slug, name, domain), title, disclosed date, records and their basis, attack type, sector, data types, status (disclosed, confirmed, settled), verified, campaign, the sources that back it, and the page URL.", "parameters": [ { "name": "sector", "in": "query", "required": false, "description": "Only this sector", "schema": { "type": "string", "enum": [ "tech", "ai", "data", "health", "insurance", "finance", "crypto", "retail", "telecom", "government", "education", "hospitality", "media", "gaming", "energy", "transport", "manufacturing", "legal", "nonprofit", "other" ] }, "example": "health" }, { "name": "attack", "in": "query", "required": false, "description": "Only this attack type", "schema": { "type": "string", "enum": [ "ransomware", "hacking", "supply-chain", "third-party", "credential-stuffing", "phishing", "misconfiguration", "insider", "lost-device", "scraping", "ai-model", "extortion", "unknown" ] }, "example": "ransomware" }, { "name": "data", "in": "query", "required": false, "description": "Only breaches that exposed this data type", "schema": { "type": "string", "enum": [ "names", "emails", "passwords", "phone", "addresses", "dob", "ssn", "government-id", "financial", "payment-card", "health", "insurance", "biometrics", "location", "credentials", "api-keys", "source-code", "internal-docs", "prompts", "training-data", "messages", "ip-addresses", "employment", "education", "children", "other" ] }, "example": "ssn" }, { "name": "year", "in": "query", "required": false, "description": "Only breaches disclosed in this year", "schema": { "type": "integer" }, "example": 2026 }, { "name": "company", "in": "query", "required": false, "description": "Only this organization (companies.fru.dev slug)", "schema": { "type": "string" }, "example": "change-healthcare" }, { "name": "verified", "in": "query", "required": false, "description": "true for confirmed rows only", "schema": { "type": "boolean" }, "example": true }, { "name": "since", "in": "query", "required": false, "description": "Only rows disclosed, first seen or updated at or after this date (YYYY-MM-DD)", "schema": { "type": "string" }, "example": "2026-09-01" }, { "name": "limit", "in": "query", "required": false, "description": "Items per page, 1 to 200", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 200 } }, { "name": "offset", "in": "query", "required": false, "description": "Items to skip, for the next page", "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "breaches with id, organization (slug, name, domain), title, disclosed date, records and their basis, attack type, sector, data types, status (disclosed, confirmed, settled), verified, campaign, the sources that back it, and the page URL", "content": { "application/json": { "schema": { "type": "object" }, "example": { "breaches": [ { "id": "check-point-2026-09", "organization": { "slug": "check-point", "name": "Check Point", "domain": "checkpoint.com", "url": "https://breaches.fru.dev/companies/check-point" }, "title": "Check Point warns of hackers exploiting Security Gateway VPN RCE flaw", "disclosed": "2026-09-23", "records": null, "records_basis": null, "attack": "hacking", "sector": "tech", "data_types": [], "status": "disclosed", "verified": false, "campaign": null, "country": null, "sources": [ "press" ] }, { "id": "limeleads-2026-09", "organization": { "slug": "limeleads", "name": "LimeLeads", "domain": "limeleads.com", "url": "https://breaches.fru.dev/companies/limeleads" }, "title": null, "disclosed": "2026-09-22", "records": 17838396, "records_basis": "hibp", "attack": "misconfiguration", "sector": "tech", "data_types": [ "emails", "employment" ], "status": "disclosed", "verified": false, "campaign": null, "country": null, "sources": [ "hibp" ] } ], "total": 1152, "limit": 3, "offset": 0, "next": "/api/breaches?sector=tech&limit=3&offset=3", "note": "From public sources only. verified=true means an official notice, a filing, a regulator or the organization confirmed it. records are as ..." } } } } } } }, "/api/breaches/{id}": { "get": { "operationId": "get_breach", "summary": "One breach with every source, the official notices it was matched to, and its change history", "description": "One breach with every source, the official notices it was matched to, and its change history. Returns the breach with summary, occurred, discovered and disclosed dates, records, data types, attack, lawsuit or fine, sources (url, type, title), notices (portal, date, people affected in that state) and history (field, old, new, when, source).", "parameters": [ { "name": "id", "in": "path", "required": true, "description": "Breach id, as in /breaches/", "schema": { "type": "string" }, "example": "change-healthcare-2024-08" } ], "responses": { "200": { "description": "the breach with summary, occurred, discovered and disclosed dates, records, data types, attack, lawsuit or fine, sources (url, type, title), notices (portal, date, people affected in that state) and history (field, old, new, when, source)", "content": { "application/json": { "schema": { "type": "object" }, "example": { "breach": { "id": "change-healthcare-2024-08", "organization": { "slug": "change-healthcare", "name": "Change Healthcare", "domain": "changehealthcare.com", "url": "https://breaches.fru.dev/companies/change-healthcare" }, "title": "Ransomware attack on Change Healthcare exposes data of about 190 million people", "disclosed": "2024-02-22", "records": 190000000, "records_basis": "organization", "attack": "ransomware", "sector": "health", "data_types": [ "names", "addresses" ], "status": "confirmed", "verified": true, "campaign": null, "country": "US", "sources": [ { "url": "https://oag.ca.gov/privacy/databreach/list?field_sb24_org_name_value=Change%20Healthcare", "type": "official", "title": "California Attorney General breach notice: Change Healthcare", "source": "ca-ag" }, { "url": "https://www.atg.wa.gov/data-breach-notifications", "type": "official", "title": "Washington Attorney General breach notice: Change Healthcare", "source": "wa-ag" } ] }, "note": "From public sources only. verified=true means an official notice, a filing, a regulator or the organization confirmed it. records are as ..." } } } }, "404": { "description": "Not found" } } } }, "/api/companies": { "get": { "operationId": "list_companies", "summary": "Organizations with a known breach, with their breaches as dated items (the companies.fru.dev registry feed)", "description": "Organizations with a known breach, with their breaches as dated items (the companies.fru.dev registry feed). Returns companies with slug (companies.fru.dev slug rule), name, domain, in_registry, sector, the page here, breach count, records, first seen, and items (each breach with type, date, title, url, source, verified). By default only organizations with a known web domain; all=1 for every organization.", "parameters": [ { "name": "since", "in": "query", "required": false, "description": "Only rows disclosed, first seen or updated at or after this date (YYYY-MM-DD)", "schema": { "type": "string" }, "example": "2026-09-01" }, { "name": "all", "in": "query", "required": false, "description": "Include organizations without a known domain (mostly from state notices)", "schema": { "type": "boolean" }, "example": false }, { "name": "limit", "in": "query", "required": false, "description": "Items per page, 1 to 200", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 200 } }, { "name": "offset", "in": "query", "required": false, "description": "Items to skip, for the next page", "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "companies with slug (companies.fru.dev slug rule), name, domain, in_registry, sector, the page here, breach count, records, first seen, and items (each breach with type, date, title, url, source, verified). By default only organizations with a known web domain; all=1 for every organization", "content": { "application/json": { "schema": { "type": "object" }, "example": { "companies": [ { "slug": "services-australia", "site_slug": "services-australia", "name": "Services Australia", "domain": "servicesaustralia.gov.au", "in_registry": false, "sector": "government", "url": "https://breaches.fru.dev/companies/services-australia", "breaches": 1, "records": 0, "first_seen": "2026-09-25 05:30:31", "source_url": "https://www.pm.gov.au/media/press-conference-new-york", "verified": true, "items": [ { "type": "breach", "date": "2026-09-24", "title": "Services Australia: OpenAI research agents breached Medicare statistics portal", "url": "https://breaches.fru.dev/breaches/services-australia-2026-09", "source": "research", "verified": true } ], "updated": "2026-09-24" }, { "slug": "astrana-health", "site_slug": "astrana-health", "name": "Astrana Health", "domain": "astranahealth.com", "in_registry": false, "sector": "health", "url": "https://breaches.fru.dev/companies/astrana-health", "breaches": 1, "records": 0, "first_seen": "2026-09-25 05:24:17", "source_url": "https://www.sec.gov/Archives/edgar/data/1083446/000110465926109813/asth-20260922x8k.htm", "verified": true, "items": [ { "type": "breach", "date": "2026-09-23", "title": "Astrana Health: Astrana Health says phone-spoofing social engineering led to data theft", "url": "https://breaches.fru.dev/breaches/astrana-health-2026-09", "source": "research,press,sec-8k", "verified": true } ], "updated": "2026-09-23" } ], "total": 1636, "limit": 2, "offset": 0, "next": "/api/companies?since=2026-09-01&limit=2&offset=2" } } } } } } }, "/api/stats": { "get": { "operationId": "list_stats", "summary": "Counts by sector, attack type, data type and year, plus the coverage grid by year and source", "description": "Counts by sector, attack type, data type and year, plus the coverage grid by year and source. Returns growth (total, verified, disclosed in the last 7 and 30 days, organizations), sectors, attacks, data types and years with breach and record counts, and coverage per year per source.", "parameters": [], "responses": { "200": { "description": "growth (total, verified, disclosed in the last 7 and 30 days, organizations), sectors, attacks, data types and years with breach and record counts, and coverage per year per source", "content": { "application/json": { "schema": { "type": "object" }, "example": { "growth": { "total": 8148, "verified": 6882, "added7d": 0, "added30d": 0, "disclosed7d": 19, "disclosed30d": 88, "orgs": 7657, "orgsAdded30d": 0, "records": 15411100437 }, "sectors": [ { "key": "other", "breaches": 2356, "records": 122061557, "verified": 2346 }, { "key": "health", "breaches": 1804, "records": 567284678, "verified": 1778 } ], "attacks": [ { "key": "unknown", "breaches": 4659, "records": 3923688445, "verified": 4185 }, { "key": "hacking", "breaches": 2024, "records": 5921429169, "verified": 1608 } ], "data_types": [ { "key": "names", "breaches": 2181, "records": 10846293316, "verified": 1486 }, { "key": "emails", "breaches": 1232, "records": 13773381633, "verified": 223 } ], "years": [ { "key": "2026", "breaches": 1011, "records": 647931474, "verified": 853 }, { "key": "2025", "breaches": 1248, "records": 2534816069, "verified": 1033 } ], "coverage": [ { "year": 2026, "bySource": { "ca-ag": 351, "research": 202, "press": 4, "sec-8k": 18, "hibp": 99, "or-doj": 117, "wa-ag": 144, "hhs-ocr": 359, "de-doj": 22, "trust:paypal": 1 }, "total": 1011, "verified": 853 }, { "year": 2025, "bySource": { "hhs-ocr": 333, "wa-ag": 200, "ca-ag": 467, "or-doj": 236, "research": 265, "hibp": 85, "de-doj": 58, "sec-8k": 14, "lawsuits": 1 }, "total": 1248, "verified": 1033 } ], "built_at": "2026-09-25 10:11:45", "note": "coverage: breaches per disclosure year, and how many of them each source backs." } } } } } } }, "/api/sources": { "get": { "operationId": "list_sources", "summary": "The growing list of sources the scan reads, with when each last answered and what it yielded", "description": "The growing list of sources the scan reads, with when each last answered and what it yielded. Returns sources with id, name, kind (portal, regulator, filing, api, rss, trust, sibling, registry), URL, scope, status, found by, first seen, last ok, yield and breaches added.", "parameters": [], "responses": { "200": { "description": "sources with id, name, kind (portal, regulator, filing, api, rss, trust, sibling, registry), URL, scope, status, found by, first seen, last ok, yield and breaches added", "content": { "application/json": { "schema": { "type": "object" }, "example": { "sources": [ { "id": "cisa-kev", "name": "CISA Known Exploited Vulnerabilities", "kind": "api", "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", "scope": "Exploited vulnerabilities, context for supply-chain waves (not breaches by themselves)", "cadence": "weekly", "status": "active", "foundBy": "seed", "firstSeen": "2026-09-25 05:12:52", "lastChecked": "", "lastOk": "", "lastError": "", "yield": 0, "added": 0 }, { "id": "hibp", "name": "Have I Been Pwned", "kind": "api", "url": "https://haveibeenpwned.com/api/v3/breaches", "scope": "Breaches whose data was loaded and verified by HIBP, with account counts", "cadence": "daily", "status": "active", "foundBy": "seed", "firstSeen": "2026-09-25 05:12:51", "lastChecked": "2026-09-25 05:34:09", "lastOk": "2026-09-25 05:34:09", "lastError": "", "yield": 965, "added": 926 } ], "total": 50, "note": "The list grows: each weekly run probes registry companies for their own security, trust and news pages." } } } } } } }, "/api/changes": { "get": { "operationId": "list_changes", "summary": "The append-only history: breaches added, record counts that rose, statuses and sources that changed", "description": "The append-only history: breaches added, record counts that rose, statuses and sources that changed. Returns changes with time, item type, item, field, old and new value, source URL and who made it (seed, daily, weekly, backfill, admin).", "parameters": [ { "name": "since", "in": "query", "required": false, "description": "Only rows disclosed, first seen or updated at or after this date (YYYY-MM-DD)", "schema": { "type": "string" }, "example": "2026-09-01" }, { "name": "limit", "in": "query", "required": false, "description": "Items per page, 1 to 200", "schema": { "type": "integer", "minimum": 1, "maximum": 200, "default": 200 } }, { "name": "offset", "in": "query", "required": false, "description": "Items to skip, for the next page", "schema": { "type": "integer", "minimum": 0, "default": 0 } } ], "responses": { "200": { "description": "changes with time, item type, item, field, old and new value, source URL and who made it (seed, daily, weekly, backfill, admin)", "content": { "application/json": { "schema": { "type": "object" }, "example": { "changes": [ { "at": "2026-09-25 10:12:06", "type": "breach", "item": "coupang-2025-12", "field": "status", "old": "settled", "new": "confirmed", "source": "", "by": "admin" }, { "at": "2026-09-25 10:11:45", "type": "breach", "item": "target-2013-12", "field": "lawsuit", "old": "$18.5M multistate attorneys general settlement (2017)", "new": "USD 18.5M 47-state AG settlement (May 2017)", "source": "https://ag.ny.gov/press-release/2017/ag-schneiderman-announces-185-million-multi-state-settlement-target-corporation", "by": "seed" } ], "limit": 3, "offset": 0, "next": "/api/changes?since=2026-09-01&limit=3&offset=3", "note": "Append-only." } } } } } } }, "/api/search": { "get": { "operationId": "search", "summary": "Search organizations, breaches and pages", "description": "Search organizations, breaches and pages. Returns up to 20 ranked results with title, link and one line.", "parameters": [ { "name": "q", "in": "query", "required": true, "description": "Organization or breach", "schema": { "type": "string" }, "example": "snowflake" }, { "name": "limit", "in": "query", "required": false, "description": "Results, 1 to 20", "schema": { "type": "integer", "minimum": 1, "maximum": 20, "default": 20 } } ], "responses": { "200": { "description": "up to 20 ranked results with title, link and one line", "content": { "application/json": { "schema": { "type": "object" }, "example": { "q": "ticketmaster", "results": [ { "id": "co:ticketmaster", "group": "companies", "title": "Ticketmaster", "subtitle": "1 breach ยท latest 2024-05-31", "href": "/companies/ticketmaster", "keywords": [ "ticketmaster", "ticketmaster.com" ], "logo": "https://breaches.fru.dev/api/logo?domain=ticketmaster.com&size=64", "boost": 0.6020599913279624, "score": 1050.602059991328 }, { "id": "br:ticketmaster-2024-06", "group": "items", "title": "Ticketmaster: Ticketmaster customer data stolen from Snowflake cloud database and offered for sale", "subtitle": "2024-05-31", "href": "/breaches/ticketmaster-2024-06", "keywords": [ "snowflake 2024" ], "icon": "calendar-days", "score": 740 } ] } } } } } } } } }