Have I Been Pwned Breach Monitoring n8n Workflow (15-min)

Stay ahead of data breaches with automated Have I Been Pwned monitoring every 15 minutes

This n8n workflow checks the Have I Been Pwned (HIBP) API every 15 minutes for new breaches, compares the latest results to what you’ve already seen, and triggers alerts only when something changes—complete with a simple cache mechanism using cache.json.

What this workflow does

• Polls the HIBP API every 15 minutes to retrieve the latest breach information.
• Compares current breach data against the previously notified breach.
• Reads from a cache by retrieving the last known breach stored in cache.json to avoid redundant notifications.
• Detects a new breach by checking whether the newly fetched breach differs from the cached one.
• Updates the cache with the latest breach data when a change is detected.
• Sends alerts via a “New breach” node—so you can plug in your preferred notification steps.

Use cases

• Proactive identity protection: automate monitoring so you can respond quickly when new breaches appear.
• Security awareness and reporting: let security professionals and developers track breach events without manual checking.
• Demonstrate cache behavior in n8n: a practical example of preventing duplicate alerts using cache.json.

Technical details

• No API key required: the HIBP endpoint used in this workflow does not require an API key.
• Cache logic: reads from cache.json, compares the latest breach vs cached data, and updates the cache when new activity is detected.
• n8n nodes used: if, set, no op, merge, split out, plus a sticky note for guidance.

Setup tip: Add your alert mechanism in the red box after the New breach node—this node includes the breach data so your downstream notification is straightforward to build.