--- title: Data Breach Monitoring for Your Domains description: Data breach monitoring by WatchFor. Get an alert when a breach involving your domain, or a vendor's, is added to the public Have I Been Pwned catalog, with the breach name, site and dates. canonical: https://watchfor.io/data-breach-monitoring --- # Data Breach Monitoring for Your Domains Hear when a breach involving your domain, or a vendor you share data with, is added to Have I Been Pwned, so you can reset passwords and rotate secrets before the leaked data is reused. [Get started for free](/auth/sign-up)[View pricing](/pricing) ## Data Breach Monitoring Features What each check looks at, and when it alerts ### Have I Been Pwned Catalog Each check downloads the public Have I Been Pwned list of known breaches, so you don't have to remember to look. ### Matched by Domain Enter a website address and the monitor keeps the breaches whose breached site or breach name matches that domain, subdomains included. There are no mailboxes to list or verify. ### New Breach Alerts The New Breach Within Window rule is on by default at critical severity. It opens an incident when a matching breach is new, within 48 hours by default, and notifies your channels. ### Breach Details Each match is stored with the breach name, the site it came from, when the breach happened and when it was added to the catalog. Breaches from the last two years are marked recent. ### No Repeat Noise Old breaches already in the catalog never page you, and an incident resolves on its own once its window passes, so a domain with a long history stays quiet until something new appears. ### Vendor Watch The domain doesn't have to be yours. Add a monitor for each vendor that holds your data or your team's logins, and hear when one of them shows up in a new breach. ### Lookup Problems Stay Separate If the catalog can't be fetched, that's a lookup problem, not a breach. Probe Status is off by default for this type, so a feed outage never marks your domain down. ### Scheduled Checks Breach monitors check as often as every 6 hours or as rarely as once a day. Maintenance windows and pausing work the same as on every other monitor. ## A closer look Alert when a new breach is added, not for years-old ones already listed. Each check stores the matching breaches with their breach and added dates. ## Why Choose Our Data Breach Monitoring Solution? The gap between a breach being published and you hearing about it is when leaked passwords get replayed against other services. The breach monitor closes that gap for the sites you care about: your own domain and the vendors you depend on. It watches the Have I Been Pwned catalog and alerts you when a breach involving one of those domains is added, with the dates you need to act. It doesn't look up individual email addresses; for that, use Have I Been Pwned's own domain search, which asks you to prove you own the domain. [Start monitoring now](/auth/sign-up) Watches the public Have I Been Pwned breach catalog Matches breaches by domain, subdomains included Alerts on newly published breaches, not years-old history Breach name, site, breach date and date added for every match Watch your vendors' domains as well as your own A catalog outage never marks your domain down Checks every 6 hours on the Starter plan and above Alerts on any of 16 channels, including email, Slack and PagerDuty ## How Data Breach Monitoring Works From domain to alert in four steps 1 ### Add a Domain Enter your website address, or a vendor's. The monitor takes the domain from it. 2 ### Choose the Alert New Breach Within Window is on by default with a 48-hour window. Change the window or severity, and pick where alerts go. 3 ### Checks Run on Schedule Each check downloads the breach catalog and keeps the breaches that match your domain, as often as every 6 hours. 4 ### Get the Alert When a matching breach is new, an incident opens with the breach name, site and dates. It resolves on its own once the window passes. ## Data Breach Monitoring Use Cases For teams that need to know when a breach touches them ### Your Own Site in a Breach Breaches are often found and published by outsiders first. If your domain shows up in the catalog, you hear about it from an alert, and can force password resets and turn on two-factor login before credential stuffing starts. ### Vendor & Supplier Breaches A breach at a service your team signs in to, or one that holds your customers' data, is the signal to rotate the passwords, keys and API tokens you keep there. One monitor per vendor domain covers it. ### Agencies & Portfolios Watch every client or portfolio domain from one account. Each one gets its own monitor, its own breach history and its own alerts. ### Incident Response Each match records when the breach happened and when it was published, which gives your incident notes and any notification you owe users a dated starting point. ## Frequently asked questions Everything you need to know about data breach monitoring [All questions→](/faq)[Ask us directly](/contact) What is data breach monitoring? The breach monitor watches the public Have I Been Pwned breach catalog for breaches that involve your domain, and alerts you when a new one is added. It answers one question: has a breach involving my site or company just been published? It doesn't search for individual email addresses or leaked credential lists. How does data breach monitoring work? Does it check individual email addresses? What information does an alert include? Will I get spammed if my domain is in many old breaches? How quickly will I know about a new breach? Will a Have I Been Pwned outage mark my domain as down? Does this prevent breaches from happening? Can leaked passwords really be used against my services? ## From our blog Guides, deep-dives, and best practices from the WatchFor team [Security ### Secrets Management Explained Dec 10, 2025·3 min readRead article](/blog/secrets-management)[Security ### What is a CVE? Vulnerability basics Dec 12, 2025·3 min readRead article](/blog/what-is-a-cve)[Security ### Zero Trust Explained Dec 14, 2025·3 min readRead article](/blog/zero-trust-explained) ## Ready to Start Monitoring for Data Breaches? Breach monitors are included from the Starter plan. Sign up for free, add your domain and your vendors' domains, and upgrade when you create your first monitor. [Get started for free](/auth/sign-up)[View documentation](/docs/monitors/security#data-breach) --- Canonical page: https://watchfor.io/data-breach-monitoring · Site guide: https://watchfor.io/llms.txt