Daily Email Data Breach Monitoring with Spreadsheet Log and Slack Alerts

PromptCreate

Every weekday morning at 8am, run this as a deterministic code workflow that monitors a watchlist of high-value email addresses (executives, shared mailboxes, and the personal accounts your leaders use for work) against Have I Been Pwned and records any breach exposure to a Google Sheet. Use a cron trigger. Have I Been Pwned is not a webhook or poll source, and keeping the watchlist in a Sheet lets it be edited without changing the workflow.

Start by reading the watchlist. Use Google Sheets Get Values to read the email addresses from the 'Watchlist' tab (one address per row, for example column A). Then read the existing log with Get Values on the 'Log' tab so you have every email and breach name that has already been recorded, and build a lookup of these previously logged pairs so you can tell new findings from ones already on file.

For each email address, look it up in Have I Been Pwned. Call Get Breaches for Account (request the full breach model with truncateResponse=false so you get the breach date and data classes, not just the name) and Get Pastes for Account. URL-encode the email in the path. Treat a 404 response as 'clean, no results' rather than an error, and simply move on to the next address.

For every breach and paste returned, append one row to the 'Log' tab with Append Values. Each row should contain the email address, the breach name, the breach date (BreachDate, in YYYY-MM-DD form), the exposed data classes (the DataClasses list joined into a readable string), whether the finding is new (yes if the email and breach name were not already in the log, no otherwise), and the date the check ran.

Finally, for each brand-new breach (one whose email and breach name were not already in the log), send an alert to the security channel with Slack Bot's Send a Message. Include the monitored email address, the breach name, the breach date, and the exposed data classes so the security team can act. Do not alert on breaches that were already recorded in the log. Only newly appeared breaches should trigger a message.

What does this prompt do?

Reads a watchlist of email addresses (executives, shared mailboxes, personal accounts) from a Google Sheet you control.
Checks each address against the Have I Been Pwned database of known breaches and pastes every weekday morning.
Logs every exposure to a spreadsheet tab, one row per finding, with the breach name, breach date, and what data was exposed.
Sends a Slack alert to your security channel the moment a brand-new breach appears for someone on the list.

What do I need to use this?

A Have I Been Pwned API subscription (needed to check individual email addresses).
A Google account with a spreadsheet that holds your watchlist and a tab to log findings.
A Slack workspace with a bot that can post to your security channel.

How can I customize it?

Change when it runs, for example earlier in the morning or every day instead of only weekdays.
Edit the watchlist directly in the spreadsheet to add or remove monitored addresses, with no need to touch the workflow.
Point alerts at a different Slack channel or adjust which details each alert includes.

FAQs

Which email addresses should I monitor?

Anything high-value: executive inboxes, shared mailboxes like billing@ or support@, and even the personal accounts your leaders use for work. Because the list lives in a spreadsheet, you can add or remove addresses anytime without changing the automation.

What counts as a new breach?

The workflow keeps a running log of everything it has already seen. When a breach shows up for a monitored address that is not already in the log, it is treated as new and triggers a Slack alert.

Will I get spammed with alerts for old breaches?

No. Existing breaches are quietly recorded in the log, and only brand-new appearances trigger a Slack message, so your security channel stays quiet unless something genuinely changed.

What happens if an address has never been breached?

That is the good outcome. A clean address simply produces no findings and no alert, and the workflow moves on to the next one.

Do I need a paid Have I Been Pwned plan?

Yes. Checking specific email addresses requires a Have I Been Pwned API subscription. The workflow works with any of their paid tiers.

Related templates

Call overdue Xero customers with an AI collections agent

Every weekday at 10am, an AI voice agent phones your most overdue Xero accounts, logs what each customer promised, and reports back to finance in Slack.