Recent Breaches › Developers

Free data breach API & embeddable widgets

Recent Breaches publishes a free, CORS-enabled JSON API plus live embeddable widgets — including a live cyber threat map, a real-time breach ticker, a threat-actor leaderboard and a ransomware leak feed — so you can surface up-to-the-minute breach data on your own site, dashboard, newsletter, or OSINT / threat-intelligence tooling. No key, no signup. Free for personal, research, journalistic and non-commercial use, with attribution. Data is cached ~10 minutes.

Licence & permitted use

JSON API

Example: /api/index

{
  "index_today": 138,
  "delta_pct": 38,
  "count_24h": 11,
  "count_7d": 52,
  "baseline": 7.4,
  "ransomware_7d": 19,
  "records_leaked_7d": "4.2M",
  "critical_7d": 6,
  "updated": "2026-07-11T12:00:00Z"
}

Example: /api/breaches

[
  {
    "title": "Example Corp data breach",
    "organization": "Example Corp",
    "slug": "example-corp-data-breach",
    "url": "https://recentbreaches.com/breach/example-corp-data-breach",
    "severity": "high",
    "date": "2026-07-10"
  }
]

Example: /api/kev

[
  {
    "cve": "CVE-2026-12345",
    "vendor": "Acme",
    "product": "Gateway",
    "name": "Acme Gateway RCE",
    "dateAdded": "2026-07-09",
    "dueDate": "2026-07-30",
    "ransomware": true,
    "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12345"
  }
]

Every endpoint sends Access-Control-Allow-Origin: * and a 10-minute public cache. Endpoints never error out — on trouble they return a JSON {"error":"…"} body with a 200 status.

Embeddable widgets

Every widget ships two ways: a one-line script tag that renders in place on your page (rb-widgets.js reads its data-* attributes), or a plain iframe pointing at the matching /embed/ route with the same options as query params. All are self-contained, dark-by-default and mobile-friendly. Free for non-commercial use; leave the “Powered by RecentBreaches” backlink in place.

Breach Index

The live Breach Index ring gauge (Network Core): a breach count versus baseline over the selected window (7d/28d/90d).

Script-tag embed:

<script src="https://recentbreaches.com/static/rb-widgets.js" data-widget="breach-index" data-theme="signal" data-mode="standard" data-window="7d"></script>

Iframe embed:

<iframe src="https://recentbreaches.com/embed/breach-index?theme=signal&mode=standard&window=7d" width="340" height="420" style="border:0" loading="lazy"></iframe>

Live Wire

A live ticker of the latest breach disclosures — severity, org and time, from /api/breaches.

Script-tag embed:

<script src="https://recentbreaches.com/static/rb-widgets.js" data-widget="live-wire" data-theme="signal" data-mode="standard" data-window="7d"></script>

Iframe embed:

<iframe src="https://recentbreaches.com/embed/live-wire?theme=signal&mode=standard&window=7d" width="340" height="300" style="border:0" loading="lazy"></iframe>

Actor Board

Leaderboard of the most active threat groups: victim counts, last-seen dates and cautious origin attributions, from /api/actors.

Script-tag embed:

<script src="https://recentbreaches.com/static/rb-widgets.js" data-widget="actor-board" data-theme="signal" data-mode="standard" data-window="7d"></script>

Iframe embed:

<iframe src="https://recentbreaches.com/embed/actor-board?theme=signal&mode=standard&window=7d" width="340" height="420" style="border:0" loading="lazy"></iframe>

Odometer

A rolling odometer of 7-day totals — records leaked, ransomware claims and critical breaches, from /api/index.

Script-tag embed:

<script src="https://recentbreaches.com/static/rb-widgets.js" data-widget="odometer" data-theme="signal" data-mode="standard" data-window="7d"></script>

Iframe embed:

<iframe src="https://recentbreaches.com/embed/odometer?theme=signal&mode=standard&window=7d" width="340" height="200" style="border:0" loading="lazy"></iframe>

Global Breach Grid

A rotating 3D globe of breach targets by country and hedged attacker origins, from /api/geo. Country-level (national centroids, not city-level); origins are attribution estimates.

Script-tag embed:

<script src="https://recentbreaches.com/static/rb-widgets.js" data-widget="breach-globe" data-theme="signal" data-mode="standard" data-window="28d"></script>

Iframe embed:

<iframe src="https://recentbreaches.com/embed/breach-globe?theme=signal&mode=standard&window=28d" width="520" height="420" style="border:0" loading="lazy"></iframe>

Data Release Watch

An ominous board of recent extortion-site listings: victim, attacker group, claimed data, and a live "time since listing" timer, from /api/leaks. No ransom amounts or pay-by deadlines (the data doesn't include them).

Script-tag embed:

<script src="https://recentbreaches.com/static/rb-widgets.js" data-widget="leak-watch" data-theme="signal" data-mode="cyber"></script>

Iframe embed:

<iframe src="https://recentbreaches.com/embed/leak-watch?theme=signal&mode=cyber" width="520" height="460" style="border:0" loading="lazy"></iframe>

Widget parameters

RSS feed

Subscribe to the latest breaches in any reader, or pull them server-side, via https://recentbreaches.com/feed.xml (alias /rss).

Developer FAQ