Breach Databases & Credential Leak Repositories

Have I Been Pwned (HIBP) is the gold standard for legitimate breach notification, created by security researcher Troy Hunt. It aggregates data from hundreds of publicly known breaches and allows individuals and organizations to check whether their credentials appear in known leaks. HIBP is the appropriate first stop for corporate credential monitoring and is officially recommended by multiple national cybersecurity agencies.

Key Features

• Free email and phone number lookup — check individual credentials for breach exposure
• Domain Search API — check all email addresses associated with a corporate domain across all known breaches
• Notification service — receive alerts when new breaches containing your email are identified
• Pwned Passwords API — k-anonymity model allows password hash checking without sending the full hash
• Partnership with law enforcement agencies — official channel for breach data disclosure from FBI investigations

Enterprise Implementation

Integrate the HIBP Domain Search API into your identity governance workflow. At minimum, run monthly domain scans and feed results to the Identity and Access Management (IAM) team for forced password resets on affected accounts. Best practice: integrate HIBP's Pwned Passwords API into your Active Directory password policy to block the use of passwords that appear in known breaches — Microsoft provides an Azure AD Password Protection connector that uses this data. NIST SP 800-63B explicitly recommends checking new passwords against breach corpuses during password creation.

Limitations

HIBP covers publicly disclosed breaches only. Private breach data currently trading on dark web forums that has not yet been publicly released will not appear in HIBP. For coverage of non-public breach data, supplement HIBP with deeper intelligence sources that monitor dark web markets and forums in real-time, or use a commercial threat intelligence platform with dark web monitoring capabilities.

DeHashed is a comprehensive breach search engine aggregating data from thousands of leaked databases, including many that do not appear in HIBP. It allows searching by email address, username, IP address, name, phone number, address, and password hash — the breadth of query types makes it significantly more powerful than HIBP for OSINT investigations but also makes it a preferred tool for threat actors conducting targeted credential attacks.

Defensive Research Value

• Search by multiple identifier types — finds leaked credentials associated with a person even when the email address has changed
• Password hash lookup — identify if a specific hash appears in breach data without cracking it
• IP address correlation — find accounts registered from specific IP ranges (useful for attributing threat actors)
• Username pivoting — identify all accounts associated with a specific username across multiple breaches

Threat Actor Use

Threat actors use DeHashed for credential stuffing preparation — building target lists of valid email/password combinations for specific organizations before launching automated login attacks. They also use it for spear phishing preparation, enriching known email addresses with additional personal data from breach records to craft convincing pretexts. Financial fraud actors use the address and phone number fields for identity verification bypass attacks against financial institutions.

Access and Policy

DeHashed requires paid subscription for full access. Organizations should control access through a request and approval process with audit logging. Only personnel with explicit authorization for breach intelligence research should have DeHashed credentials. Rotate API keys quarterly and log all queries with the analyst ID, timestamp, and business justification.

LeakOSINT is an OSINT correlation platform that cross-references breach data with social media profiles, public records, and other open-source intelligence sources to build comprehensive intelligence profiles from leaked data. It extends raw breach data into actionable person-of-interest profiles useful for both threat actor attribution and social engineering defense awareness.

Intelligence Correlation Capabilities

• Correlates breach data with social media accounts, public records, and other OSINT sources
• Builds person-of-interest profiles linking multiple digital identities
• Identifies relationships between breach records from different incidents
• Telegram bot interface for rapid query workflow integration
• Useful for insider threat investigations and threat actor attribution

Research Application

LeakOSINT is particularly valuable when investigating a known threat actor handle — correlating their dark web username with breach records can surface real email addresses, which in turn correlate with social media profiles, professional networks, and public records. This pivoting capability has supported successful attribution of previously anonymous threat actors in multiple law enforcement investigations. For defensive use, LeakOSINT helps security awareness teams understand exactly what information is publicly available about their executives and high-value employees — critical for building realistic spear phishing simulations.

Snusbase is a breach aggregation platform similar to DeHashed, offering searchable access to a large corpus of breach data with API access for automation. It is frequently used by threat intelligence teams for automated monitoring of organizational credential exposure. Snusbase has appeared in threat actor forums as a tool recommendation for credential harvesting, placing it in the dual-use category requiring careful access controls.

Automated Monitoring Pattern

The Snusbase API enables organizations to build automated monitoring pipelines: scheduled daily queries for all corporate email domain addresses surface newly indexed breach records within 24 hours of their addition to the database. Alert workflow: new breach record containing corporate email → SIEM alert → IAM team initiates forced password reset for affected account → investigate whether credentials were used in unauthorized access attempts. This pattern provides earlier detection than reactive breach notifications from HIBP which may lag the dark web appearance of data by days or weeks.