HaveIBeenPwned

Have I Been Pwned

The Have I Been Pwned (HIBP) module integrates with Troy Hunt's extensive data breach database. It allows you to query whether a specific email address has been compromised in any known data breaches, pastebins, or stealer logs.

Important

Data Attribution: All compromise status, breach details, compromised infrastructure data, and leaked data classes, etc., extracted by this module are exclusively provided by Have I Been Pwned.

Warning

API Key Required: This module strictly requires an active API key to function. If the HaveIBeenPwned key is missing from your configuration, the module simply will not return its functions for selection. For more details on how modules handle missing keys, refer to Global Settings and API Credentials.

Note

The HIBP API enforces strict rate limits. The module automatically handles these rate limits, including HTTP 429 backoff directives, using the delay and retry settings defined in your Global Settings and Network Configuration.

Data Source: Have I Been Pwned

Capabilities

The module accepts Emails as input and extracts the following intelligence:

• Compromise Status: If an email is found in any breach, the original Email node is automatically tagged with Compromised to highlight its vulnerability in the graph.
• Breach Identification: Extracts the core details of the breach, emitting a new Breach property (including the breach's internal Name and Title).
• Compromised Infrastructure: Extracts the specific Domain associated with the breached service. Because this domain represents a third-party service rather than your primary target, it is automatically flagged as Out Of Scope (see Scope Boundaries) to prevent scope bleeding, while remaining linked to the breach for context.
• Leaked Data Classes: Extracts exactly what type of data was compromised (e.g., "Passwords, Names, Physical addresses, IP addresses") and attaches it as a Leaked Data property.
• Breach Metadata: Deeply parses the API response to attach rich context directly to the breach node:
  • Dates: Extracts the Breach Date, Added Date (when it was added to HIBP), and Modified Date.
  • Scale & Details: Extracts the Pwn Count (total number of affected accounts), the official HTML Description of the incident, and any known Attribution.
  • References: Extracts the Disclosure URL linking to public reporting about the incident.
• Classification Tags: Automatically applies specific behavioral tags to the breach based on HIBP's classification, such as:
  • verified, fabricated, sensitive (often omitted from public searches without verification), retired, spam_list, malware, subscription_free, stealer_log.