Dark Web Monitoring for Employee and Customer Email Addresses

PromptCreate

Every Monday at 7am on a cron trigger, sweep our staff and customer email list against known dark web breach dumps so we find out about compromised credentials before an attacker uses them.

Start by reading the email addresses from our Google Sheet with Get Values. The addresses live in a single column on a dedicated tab, so read that range and treat each non-empty cell as one address to check. Trim whitespace, skip blank cells, and de-duplicate the list so a repeated address does not burn an extra lookup.

For each address, call IPQualityScore Dark Web Leak Lookup to check whether it appears in public data breaches or private leaked-credential dumps. Two details matter here. First, the Dark Web Leak endpoint puts the API key in an unusual path position, after the type segment, as /leaked/{type}/{apiKey}/{data}, unlike other IPQualityScore endpoints which use /<product>/{apiKey}/<value>. Second, IPQualityScore returns HTTP 200 even when a call fails, so branch on the success field in the response body rather than the status code, and record a lookup error for that address instead of silently treating it as clean.

Write the results back into the sheet with Append Values so each run leaves a dated audit row per address: the run date, the email address, whether a leak was found, and which breach source it came from. This append-only history is what makes each sweep auditable, and it is also the input for next week's comparison.

Before posting anything, diff this run against the previous run's rows in the same tab to work out which exposures are new. An address counts as newly exposed when this run found a leak for it and the most recent earlier audit row for that address did not, or when the address has no earlier row at all. Exposures that were already reported in a previous week stay out of the callout.

Finish with a single Slack Send a Message to our security channel covering the count of addresses checked, the count newly exposed, and the specific addresses that are newly compromised since last week, each with the breach source it came from. Only newly appearing leaks should be called out by name so the alert stays actionable instead of repeating the same known exposures every week. If nothing new appeared, still post the summary with a count of zero so we know the sweep actually ran.

Keep the address list bounded. Each lookup consumes IPQualityScore account credits, so the size of the range read from the sheet drives the cost of every weekly run.

What does this prompt do?

Reads your list of staff and customer email addresses straight from a Google Sheet, so the list stays somewhere your team can actually edit.
Checks every address against known data breaches and leaked credential dumps first thing Monday morning.
Logs a dated result row for each address back into the same sheet, building an audit trail of who was checked, when, and what turned up.
Posts a single Slack summary to your security channel with how many addresses were checked, how many are newly exposed, and exactly which ones are new this week.

What do I need to use this?

A Google account with a sheet holding your staff and customer email addresses, one address per row
An IPQualityScore account for the breach lookups (each address checked uses account credits, so cost scales with list size)
A Slack workspace and the channel where security alerts should land

How can I customize it?

Change when it runs. Monday at 7am is just a starting point, and daily or monthly sweeps work the same way.
Point it at a different sheet or column to sweep a different group, and trim or expand that list to control cost, since every address checked uses credits.
Send the summary somewhere else, such as a private security channel or a direct message to whoever owns incident response.

FAQs

Does this show me the actual leaked passwords?

No. The check tells you whether an address turns up in a known breach and which source it came from, so you know who to ask for a password reset. Treat it as a signal to act on rather than a place to look up credentials.

Will it repeat the same breaches at me every week?

No, and that is the main point of running it weekly. Addresses flagged in an earlier run stay in the sheet's audit history but are not named again in Slack. Only leaks that appear for the first time get called out by name, so the alert stays worth reading.

How many email addresses can I check?

As many as you like, though each address checked uses credits from your IPQualityScore account. Most teams start with all staff plus their highest-value customer contacts and expand the list once they see the weekly cost.

What happens when someone new is added to the sheet?

They get picked up automatically on the next Monday run. Because they have no earlier history in the sheet, any leak found on their first sweep counts as newly exposed and gets named in that week's Slack alert.

Do I need a security team to run this?

No. All it takes is a spreadsheet of addresses, an IPQualityScore account, and a Slack channel. The workflow does the checking and tells you in plain terms who needs to reset a password.

Related templates

Auto-fix your calendar when a flight slips, and flag what's at risk

When your flight moves, your calendar times get corrected automatically and you get a Slack note naming the meetings you're about to miss.

Agentic Task

Trace phishing emails to the sending IP and report abuse

Every 15 minutes, forwarded phishing reports get traced back to the server that really sent them, with a verdict in Slack and the worst senders reported.

Agentic Task

Weekly Amazon S3 bucket security audit posted to Slack

Every Monday, check every S3 bucket for public exposure, missing encryption and weak backup settings, then get the risks ranked in Slack.

Agentic Task

Turn procurement portal tenders into CRM deals each morning

Every weekday at 7am, sign in to the tender portals you track, filter new notices against your bid criteria, and open a deal for the ones worth chasing.