n8n Workflow: Have I Been Pwned Breach Monitor to Google Sheets & Alerts

Get alerted only when a new breach matters—automatically

This n8n workflow monitors Have I Been Pwned for the latest breaches, scores each one against your risk rules and watchlist, logs every result to Google Sheets, and sends Gmail and Slack alerts only when the breach clears your configured threshold.

What this workflow does

• Runs daily at 08:00 (or you can trigger it manually via the n8n manual trigger).
• Auto-prepares your Google Sheet: checks the sheet’s first row and writes the header row automatically if it’s missing.
• Fetches the latest breach using the Have I Been Pwned latestbreach endpoint—no HIBP API key required.
• Avoids duplicate logging: loads prior breach history from Google Sheets and skips processing if the same breach record was already logged (unless HIBP has revised it, or reprocessing is enabled).
• Scores breach severity from 0–10+ based on:
  • records exposed
  • sensitive data types (including passwords, financial data, government IDs, and health data)
  • HIBP’s own verified/sensitive flags
  • your domain or keyword watchlist
• Logs every run outcome to Google Sheets (append new rows or update existing ones) to maintain a complete audit trail.
• Alerts only above your threshold: if the score meets your configured level, it sends a formatted HTML email via Gmail and a Slack Block Kit card via the Slack API; otherwise it runs quietly.

Use cases

• SaaS security monitoring: detect impactful breaches that may affect your customers.
• Ops teams: maintain a searchable breach history in Google Sheets with consistent scoring.
• Automation engineers: deploy an n8n workflow that escalates only high-risk events through Gmail and Slack.

Technical details

• Scheduling: daily at 08:00 + manual trigger
• Integrations: Google Sheets OAuth2, Gmail, Slack API
• n8n nodes/logic: if, set, code, no op, gmail, email send

Set it up by creating a Google Sheet, noting the Sheet ID and tab name, then connecting your Google Sheets OAuth2 credential in n8n.