LiveBreach Intelligence: data breaches, leaks & ransomware, tracked as they surfaceOngoing protection: GalaxyWarden →
Recent BreachesData breach tracker
NewsletterFree scan

Recent Breaches › Developers

Free data breach API & embeddable widgets

Recent Breaches publishes a free, CORS-enabled JSON API plus live embeddable widgets — including a live cyber threat map, a real-time breach ticker, a threat-actor leaderboard and a ransomware leak feed — so you can surface up-to-the-minute breach data on your own site, dashboard, newsletter, or OSINT / threat-intelligence tooling. No key, no signup. Free for personal, research, journalistic and non-commercial use, with attribution. Data is cached ~10 minutes.

ShareXLinkedInFacebookRedditWhatsAppTelegram

Licence & permitted use

Free for personal, research, journalistic and other non-commercial use. Use it in your dashboard, your newsletter, your research, your reporting, your SOC wall screen or your side project.

Attribution is required. Show a visible credit with a working link back to recentbreaches.com on every surface where the data or a widget appears. The widgets ship with a “Powered by RecentBreaches” backlink; please leave it in.

Commercial use is not granted by default. Some records derive from upstream sources whose own terms restrict commercial use and redistribution, and we cannot sublicense rights we do not hold. Email press@recentbreaches.com to discuss commercial licensing and we will tell you plainly what is and is not possible.

Upstream sources retain their own rights. The principal ones are ransomware.live, Have I Been Pwned (breach data, used under CC BY 4.0), CISA’s Known Exploited Vulnerabilities catalog, SEC EDGAR Form 8-K. Individual records may also cite the news outlet that reported them, linked on the record. Complying with their terms is your responsibility as well as ours.

Please be kind to the service. Responses are cached ~10 minutes — cache on your side rather than polling in a tight loop. We may rate-limit, degrade or revoke access we judge abusive, and we may change or withdraw any endpoint.

Full terms: Terms of Service §6 — API, feeds and widgets.

JSON API

GEThttps://recentbreaches.com/api/breachesLatest ~50 published breaches. Optional ?limit= (cap 200).
GEThttps://recentbreaches.com/api/indexThe live Breach Index aggregate (24h/7d counts, delta, records).
GEThttps://recentbreaches.com/api/kevLatest ~50 CISA Known Exploited Vulnerabilities. Optional ?limit=.
GEThttps://recentbreaches.com/api/seriesDaily breach counts + records estimate. Optional ?days= (default 28, cap 90).
GEThttps://recentbreaches.com/api/actorsMost-active threat actors with hedged origin attribution. Optional ?limit= (cap 25).
GEThttps://recentbreaches.com/api/data-classesTop 12 data classes exposed. Optional ?window=7d|28d|90d.
GEThttps://recentbreaches.com/api/geoBreach targets by country + hedged actor origins. Optional ?window=7d|28d|90d.
GEThttps://recentbreaches.com/api/leaksRecent ransomware/extortion leak-site listings (Data Release Watch): group, victim, sector, country, claimed data, listing recency. No ransom amounts or deadlines.
GEThttps://recentbreaches.com/api/healthService health check ({"ok":true}).
GEThttps://recentbreaches.com/feed.xmlRSS 2.0 feed of the latest breaches (alias: /rss).

Example: /api/index

{
  "index_today": 138,
  "delta_pct": 38,
  "count_24h": 11,
  "count_7d": 52,
  "baseline": 7.4,
  "ransomware_7d": 19,
  "records_leaked_7d": "4.2M",
  "critical_7d": 6,
  "updated": "2026-07-11T12:00:00Z"
}

Example: /api/breaches

[
  {
    "title": "Example Corp data breach",
    "organization": "Example Corp",
    "slug": "example-corp-data-breach",
    "url": "https://recentbreaches.com/breach/example-corp-data-breach",
    "severity": "high",
    "date": "2026-07-10"
  }
]

Example: /api/kev

[
  {
    "cve": "CVE-2026-12345",
    "vendor": "Acme",
    "product": "Gateway",
    "name": "Acme Gateway RCE",
    "dateAdded": "2026-07-09",
    "dueDate": "2026-07-30",
    "ransomware": true,
    "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12345"
  }
]

Every endpoint sends Access-Control-Allow-Origin: * and a 10-minute public cache. Endpoints never error out — on trouble they return a JSON {"error":"…"} body with a 200 status.

Embeddable widgets

Every widget ships two ways: a one-line script tag that renders in place on your page (rb-widgets.js reads its data-* attributes), or a plain iframe pointing at the matching /embed/ route with the same options as query params. All are self-contained, dark-by-default and mobile-friendly. Free for non-commercial use; leave the “Powered by RecentBreaches” backlink in place.

Breach Index

The live Breach Index ring gauge (Network Core): a breach count versus baseline over the selected window (7d/28d/90d).

Script-tag embed:

<script src="https://recentbreaches.com/static/rb-widgets.js" data-widget="breach-index" data-theme="signal" data-mode="standard" data-window="7d"></script>

Iframe embed:

<iframe src="https://recentbreaches.com/embed/breach-index?theme=signal&mode=standard&window=7d" width="340" height="420" style="border:0" loading="lazy"></iframe>

Live Wire

A live ticker of the latest breach disclosures — severity, org and time, from /api/breaches.

Script-tag embed:

<script src="https://recentbreaches.com/static/rb-widgets.js" data-widget="live-wire" data-theme="signal" data-mode="standard" data-window="7d"></script>

Iframe embed:

<iframe src="https://recentbreaches.com/embed/live-wire?theme=signal&mode=standard&window=7d" width="340" height="300" style="border:0" loading="lazy"></iframe>

Actor Board

Leaderboard of the most active threat groups: victim counts, last-seen dates and cautious origin attributions, from /api/actors.

Script-tag embed:

<script src="https://recentbreaches.com/static/rb-widgets.js" data-widget="actor-board" data-theme="signal" data-mode="standard" data-window="7d"></script>

Iframe embed:

<iframe src="https://recentbreaches.com/embed/actor-board?theme=signal&mode=standard&window=7d" width="340" height="420" style="border:0" loading="lazy"></iframe>

Odometer

A rolling odometer of 7-day totals — records leaked, ransomware claims and critical breaches, from /api/index.

Script-tag embed:

<script src="https://recentbreaches.com/static/rb-widgets.js" data-widget="odometer" data-theme="signal" data-mode="standard" data-window="7d"></script>

Iframe embed:

<iframe src="https://recentbreaches.com/embed/odometer?theme=signal&mode=standard&window=7d" width="340" height="200" style="border:0" loading="lazy"></iframe>

Global Breach Grid

A rotating 3D globe of breach targets by country and hedged attacker origins, from /api/geo. Country-level (national centroids, not city-level); origins are attribution estimates.

Script-tag embed:

<script src="https://recentbreaches.com/static/rb-widgets.js" data-widget="breach-globe" data-theme="signal" data-mode="standard" data-window="28d"></script>

Iframe embed:

<iframe src="https://recentbreaches.com/embed/breach-globe?theme=signal&mode=standard&window=28d" width="520" height="420" style="border:0" loading="lazy"></iframe>

Data Release Watch

An ominous board of recent extortion-site listings: victim, attacker group, claimed data, and a live "time since listing" timer, from /api/leaks. No ransom amounts or pay-by deadlines (the data doesn't include them).

Script-tag embed:

<script src="https://recentbreaches.com/static/rb-widgets.js" data-widget="leak-watch" data-theme="signal" data-mode="cyber"></script>

Iframe embed:

<iframe src="https://recentbreaches.com/embed/leak-watch?theme=signal&mode=cyber" width="520" height="460" style="border:0" loading="lazy"></iframe>

Widget parameters

AttributeValuesWhat it does
data-widgetbreach-index | live-wire | actor-board | odometer | breach-globe | leak-watchWhich widget the script renders (script-tag embeds; iframes pick it via the /embed/ URL).
data-themesignal | terminal | slate | ice | lightColor theme. signal (default) is the dark editorial look; light for light pages.
data-modestandard | cyberRendering mode — see the Standard vs Cyberpunk note below.
data-window7d | 28d | 90dTime window the widget aggregates over (default 7d).
data-palettelime | ice | amber | violetAccent palette for charts, sparklines and highlights.
Standard
Clean editorial rendering — flat panels, quiet typography. Blends into newsrooms, blogs and corporate dashboards.
Cyberpunk (cyber)
Neon glow, scanlines and terminal flicker — built for SOC wall screens, stream overlays and landing pages that want the drama.

RSS feed

Subscribe to the latest breaches in any reader, or pull them server-side, via https://recentbreaches.com/feed.xml (alias /rss).

Commercial monitoring — GalaxyWarden Signals

The API above is free for non-commercial use, and for a large share of these records we cannot grant commercial rights at any price — the upstream terms forbid it and we cannot sublicense what we do not hold. That is a real limit, not a sales tactic, and no payment changes it.

If what you actually need is to monitor named organisations in a commercial setting, that is a separate product rather than a licence for this feed. GalaxyWarden Signals takes a watchlist of organisations and emails you when one of them discloses a cybersecurity incident in an SEC Form 8-K (Item 1.05) or appears in a corroborated breach catalogue, with a JSON API returning the same records and the filing behind each one.

It is built only on the sources we can license for business use. The ransomware leak-site claims that make up most of this feed are deliberately not part of it, so it is a narrower dataset than the one on this page — and one you can put in a commercial product without inheriting our licensing problem.

$499/month or $4,990/year. It monitors organisations, not people: it does not scan you and it does not remove your details from data brokers. GalaxyWarden Signals →

Developer FAQ

Is the Recent Breaches data breach API free?
Yes — the API is free, there is no API key and no signup. It is offered for personal, research, journalistic and other non-commercial use, and attribution (a visible link back to recentbreaches.com) is required wherever you use the data or a widget.
Do I need an API key or authentication?
No. Every endpoint is public and CORS-enabled (it sends Access-Control-Allow-Origin: *), so you can call it straight from the browser or server-side with no token.
What are the rate limits?
There is no published per-key limit, because there are no keys. Every response is cached for about 10 minutes, so please cache on your side rather than polling in a tight loop. We may rate-limit, degrade or revoke access we judge abusive, and we may change or withdraw any endpoint. Endpoints never hard-fail — on trouble they return a JSON {"error":"…"} body with a 200 status.
What data does the API return?
Latest published breaches, the live Breach Index aggregate, CISA Known Exploited Vulnerabilities (KEV), a daily counts series, the most-active threat actors, the top exposed data classes, breach geography by country, and recent ransomware leak-site listings — plus an RSS feed of the latest breaches.
Can I embed the breach widgets on my own site?
Yes. Every widget (Breach Index, Live Wire, Actor Board, Odometer, Global Breach Grid and Data Release Watch) embeds two ways: a one-line script tag, or a plain iframe pointing at the matching /embed/ route. They are self-contained, dark-by-default and mobile-friendly.
Do you have a live cyber threat map or breach ticker widget?
Yes. The Global Breach Grid is a free live cyber-attack map — breaches plotted by country with hedged attacker origins — and Live Wire is a real-time breach ticker. Both embed free with a script tag or iframe, and are popular on security dashboards, SOC wall screens, stream overlays and blog sidebars.
Is there a breach data feed for OSINT or threat intelligence?
Yes. The same free API doubles as an OSINT / threat-intelligence feed: JSON endpoints for breaches, CISA KEV, threat actors, exposed data classes, breach geography and ransomware leak-site listings, plus an RSS feed — all CORS-open and key-free for your tooling, research or monitoring.
Can I use the data commercially?
Commercial use is not granted by default. Some records derive from upstream sources whose own terms restrict commercial use and redistribution, and we cannot sublicense rights we do not hold. If you want to use the data in a commercial product or service, email press@recentbreaches.com and we will tell you what is possible and help arrange licensing where it is.
Who owns the underlying breach data?
We own our own writing, ratings, grades, indexes and widget code. The underlying records come from upstream sources that retain their own rights and impose their own terms — principally ransomware.live, Have I Been Pwned (breach data, used under CC BY 4.0), CISA’s Known Exploited Vulnerabilities catalog, and SEC EDGAR Form 8-K filings. Some records are additionally sourced from public reporting located by automated search, in which case we link the outlet we relied on. If you use our API you are responsible for complying with those terms too.
What exactly do I have to do to attribute Recent Breaches?
Show a visible credit with a working link back to recentbreaches.com on every surface where the data or a widget appears — for example "Breach data from Recent Breaches" linking to https://recentbreaches.com. The widgets ship with a "Powered by RecentBreaches" backlink built in; please leave it in place.
Building something with our data?
Non-commercial projects: just attribute us with a link back to recentbreaches.com. Commercial projects: talk to us first at press@recentbreaches.com. Check your own exposure while you’re here.
Check if you’re exposed →