CybersecurityMonitoring

Breach Alerts

Warn users the moment their email address shows up in a newly disclosed data breach.

Start with 500 free creditsDocumentation

Email breaches · 1 credit per lookup · no monthly fee

New breach: DataCo

Your email was exposed · just now

Secure account

The problem

When a breach containing your users' credentials goes public, the clock starts: attackers begin credential-stuffing within hours. Users who find out from the news, or from a hijacked account, remember who failed to warn them.

With Encrata

Check addresses on a schedule and alert users the moment a new breach names them. The response returns which service leaked, when, and what data classes were exposed, so your alert can say something useful: 'LinkedIn breach, passwords included, change yours if reused.'

How it works

1

Send the address

Call the breach endpoint with an email address, one-off for a signup check, or on a schedule for monitoring.

2

We check known breaches

Encrata searches disclosed breach data and returns every breach the address appears in, when it happened, and what leaked.

3

Respond to exposure

Alert the user, raise a risk score, force a reset or require MFA, the full breach history is one credit away.

One call, structured answer

Breach Alerts runs on the email breaches lookup at 1 credit per lookup. Same API key, same JSON shape as every other Encrata lookup.

  • Full breach history, names, dates and exposed data classes per breach
  • 1 credit per check, so continuous monitoring stays affordable
  • New-breach detection turns a public leak into a same-day security response
  • Works for one address or your whole domain
Terminal
curl -X POST "https://encrata.com/api/agent/breaches" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email": "sam@corp.com"}'
response.json
{
  "email": "sam@corp.com",
  "breached": true,
  "breach_info": {
    "breach_count": 2,
    "services": [
      { "name": "LinkedIn", "breach_date": "2012-05-05",
        "data_types": ["Email addresses", "Passwords"] }
    ],
    "exposed_data": ["Email addresses", "Passwords"]
  },
  "credits": 1
}

Monitor, diff, alert

Build the loop in three parts: a scheduled sweep over monitored addresses, a diff against each address's last known breach list, and an alert path for anything new. The response's service names, dates and exposed data classes give the alert its substance, tell users exactly what leaked and from where, not just that something did.

Timing is the whole product

Timing is the product: an alert that lands the day a breach goes public beats the attacker's stuffing run; one that lands a month later is a news summary. Free repeats within the billing window keep a tight sweep cadence affordable, so err toward checking more often, the cost of a redundant check is zero, the cost of a late alert is a takeover.

More email breaches use cases

View all

Identity risk

78/100
4 prior breaches · manual review

Risk Scoring

Raise risk scores for identities with prior breach exposure before approving transactions

FintechRisk
Breach affects 3 users
Password resets sent

Password Reset

Trigger targeted password resets when a breach relevant to your users becomes public

SaaSSecurity
sam@corp.comBreached
MFA now required
•••

MFA Enforcement

Require stronger authentication for accounts whose emails appear in known breaches

BankingAuthentication
Start with 500 free credits
$curl https://encrata.com/api/agent/lookup -H "Authorization: Bearer YOUR_API_KEY" -d '{"e": "satya@microsoft.com"}'