Weekly dark web breach check for staff and customer emails
Every Monday, check every staff and customer email address against known breach dumps and get one Slack alert naming only the newly compromised ones.
IPQualityScore
Google Sheets
SlackOperationsEngineeringNotifications & AlertsResearch & MonitoringEvery Monday at 7am on a cron trigger, sweep our staff and customer email list against known dark web breach dumps so we find out about compromised credentials before an attacker uses them.
Start by reading the email addresses from our Google Sheet with Get Values. The addresses live in a single column on a dedicated tab, so read that range and treat each non-empty cell as one address to check. Trim whitespace, skip blank cells, and de-duplicate the list so a repeated address does not burn an extra lookup.
For each address, call IPQualityScore Dark Web Leak Lookup to check whether it appears in public data breaches or private leaked-credential dumps. Two details matter here. First, the Dark Web Leak endpoint puts the API key in an unusual path position, after the type segment, as /leaked/{type}/{apiKey}/{data}, unlike other IPQualityScore endpoints which use /<product>/{apiKey}/<value>. Second, IPQualityScore returns HTTP 200 even when a call fails, so branch on the success field in the response body rather than the status code, and record a lookup error for that address instead of silently treating it as clean.
Write the results back into the sheet with Append Values so each run leaves a dated audit row per address: the run date, the email address, whether a leak was found, and which breach source it came from. This append-only history is what makes each sweep auditable, and it is also the input for next week's comparison.
Before posting anything, diff this run against the previous run's rows in the same tab to work out which exposures are new. An address counts as newly exposed when this run found a leak for it and the most recent earlier audit row for that address did not, or when the address has no earlier row at all. Exposures that were already reported in a previous week stay out of the callout.
Finish with a single Slack Send a Message to our security channel covering the count of addresses checked, the count newly exposed, and the specific addresses that are newly compromised since last week, each with the breach source it came from. Only newly appearing leaks should be called out by name so the alert stays actionable instead of repeating the same known exposures every week. If nothing new appeared, still post the summary with a count of zero so we know the sweep actually ran.
Keep the address list bounded. Each lookup consumes IPQualityScore account credits, so the size of the range read from the sheet drives the cost of every weekly run.
Additional information
What does this prompt do?
- Reads your list of staff and customer email addresses straight from a Google Sheet, so the list stays somewhere your team can actually edit.
- Checks every address against known data breaches and leaked credential dumps first thing Monday morning.
- Logs a dated result row for each address back into the same sheet, building an audit trail of who was checked, when, and what turned up.
- Posts a single Slack summary to your security channel with how many addresses were checked, how many are newly exposed, and exactly which ones are new this week.
What do I need to use this?
- A Google account with a sheet holding your staff and customer email addresses, one address per row
- An IPQualityScore account for the breach lookups (each address checked uses account credits, so cost scales with list size)
- A Slack workspace and the channel where security alerts should land
How can I customize it?
- Change when it runs. Monday at 7am is just a starting point, and daily or monthly sweeps work the same way.
- Point it at a different sheet or column to sweep a different group, and trim or expand that list to control cost, since every address checked uses credits.
- Send the summary somewhere else, such as a private security channel or a direct message to whoever owns incident response.
FAQs
Does this show me the actual leaked passwords?
Will it repeat the same breaches at me every week?
How many email addresses can I check?
What happens when someone new is added to the sheet?
Do I need a security team to run this?
Related templates
New roof inspection requests from your website form land in JobNimbus within a minute, with no duplicate records and nothing retyped by your team.
Every weekday at 7am, your active courses are checked for missing work, silent logins, and slipping grades, with a ranked list sent to your advising channel.
Every new customer request gets a priority, triage labels, a friendly reply with the right help article, and a Slack ping only when it is truly urgent.
Every Monday at 8am, see exactly which assignments have work waiting, sorted worst first, posted to Slack and logged to a spreadsheet.
When a bot opens a version bump pull request, we read the real documentation for that exact version and tell you whether it is safe to merge.
The moment a deal hits Closed Won, the right contract starts in Ironclad, the link lands on the deal, and your sales channel hears who owns the next step.
Find compromised credentials before an attacker uses them.
Put your staff and customer email list on an automatic weekly sweep and hear about exposures only when something new turns up.