Daily data breach monitoring for key email accounts
Check key email accounts against known data breaches every weekday, log every exposure to a spreadsheet, and get a Slack alert when a new breach shows up.
Have I Been Pwned
Google Sheets
Slack BotOperationsEngineeringResearch & MonitoringNotifications & AlertsEvery weekday morning at 8am, run this as a deterministic code workflow that monitors a watchlist of high-value email addresses (executives, shared mailboxes, and the personal accounts your leaders use for work) against Have I Been Pwned and records any breach exposure to a Google Sheet. Use a cron trigger. Have I Been Pwned is not a webhook or poll source, and keeping the watchlist in a Sheet lets it be edited without changing the workflow.
Start by reading the watchlist. Use Google Sheets Get Values to read the email addresses from the 'Watchlist' tab (one address per row, for example column A). Then read the existing log with Get Values on the 'Log' tab so you have every email and breach name that has already been recorded, and build a lookup of these previously logged pairs so you can tell new findings from ones already on file.
For each email address, look it up in Have I Been Pwned. Call Get Breaches for Account (request the full breach model with truncateResponse=false so you get the breach date and data classes, not just the name) and Get Pastes for Account. URL-encode the email in the path. Treat a 404 response as 'clean, no results' rather than an error, and simply move on to the next address.
For every breach and paste returned, append one row to the 'Log' tab with Append Values. Each row should contain the email address, the breach name, the breach date (BreachDate, in YYYY-MM-DD form), the exposed data classes (the DataClasses list joined into a readable string), whether the finding is new (yes if the email and breach name were not already in the log, no otherwise), and the date the check ran.
Finally, for each brand-new breach (one whose email and breach name were not already in the log), send an alert to the security channel with Slack Bot's Send a Message. Include the monitored email address, the breach name, the breach date, and the exposed data classes so the security team can act. Do not alert on breaches that were already recorded in the log. Only newly appeared breaches should trigger a message.
Example output
Additional information
What does this prompt do?
- Reads a watchlist of email addresses (executives, shared mailboxes, personal accounts) from a Google Sheet you control.
- Checks each address against the Have I Been Pwned database of known breaches and pastes every weekday morning.
- Logs every exposure to a spreadsheet tab, one row per finding, with the breach name, breach date, and what data was exposed.
- Sends a Slack alert to your security channel the moment a brand-new breach appears for someone on the list.
What do I need to use this?
- A Have I Been Pwned API subscription (needed to check individual email addresses).
- A Google account with a spreadsheet that holds your watchlist and a tab to log findings.
- A Slack workspace with a bot that can post to your security channel.
How can I customize it?
- Change when it runs, for example earlier in the morning or every day instead of only weekdays.
- Edit the watchlist directly in the spreadsheet to add or remove monitored addresses, with no need to touch the workflow.
- Point alerts at a different Slack channel or adjust which details each alert includes.
Frequently asked questions
Which email addresses should I monitor?
What counts as a new breach?
Will I get spammed with alerts for old breaches?
What happens if an address has never been breached?
Do I need a paid Have I Been Pwned plan?
Related templates
Know the moment your key accounts are exposed.
Set up automatic breach monitoring for your most important email addresses and let your team focus on responding, not checking.