Developers
Every entity, incident and regulator action on Breach Census is available as machine-readable data — free, with no key, and no rate limit beyond fair use. Be gentle: this runs on shared infrastructure. All endpoints are read-only GET requests with open CORS (Access-Control-Allow-Origin: *).
Breach Census entity, incident and regulator-action register
Confirmed data-breach incidents, the organisations behind them, and the regulator actions and litigation that followed — sourced from public regulator filings, court records and company disclosures across the US, UK and EU.
Health check
GET https://breachcensus.com/api/health
Returns { ok: true, db: true } (200) when the database is reachable, or 503 otherwise.
Organisation — JSON
GET https://breachcensus.com/api/org/{slug}
One organisation: identity, every incident tied to it (with each incident’s event timeline), the regulator actions attached to those incidents, and a litigation summary.
curl https://breachcensus.com/api/org/acme-health400 if the slug isn’t ^[a-z0-9-]{1,200}$; 404 if no such organisation exists; 503 if the database is temporarily unavailable.
Incident — JSON
GET https://breachcensus.com/api/incident/{id}
One incident: its own facts, a summary of the organisation it happened to, its full event timeline and any regulator actions tied to it.
curl https://breachcensus.com/api/incident/1400 if the id isn’t numeric; 404 if no such incident exists (or it’s hidden); 503 if the database is temporarily unavailable.
Entity register — JSON
GET https://breachcensus.com/api/register
One page (500 rows) at a time of every organisation in the register, ordered by slug. Filter with repeatable query parameters — pass country or sector more than once to OR-match a list; omit either to leave it unfiltered. A country or sector value that matches nothing returns an empty (but still 200) results array, not an error.
curl "https://breachcensus.com/api/register?country=US&country=GB§or=healthcare&page=1"page defaults to 1; a non-integer or zero/negative page is a 400. country is matched as the uppercased 2-letter code; sector as its lowercase slug.
Entity register — CSV
GET https://breachcensus.com/api/register.csv
The same filters as the JSON register (country, sector, repeatable), unpaginated, capped at 50,000 rows, as a CSV download for spreadsheets and BI tools. The first three lines are #-prefixed comments (source, licence, generation timestamp); the header row follows.
curl "https://breachcensus.com/api/register.csv?sector=healthcare"Every response
Every successful JSON response includes source, licence and generated_at fields, and every response (success or error) carries an X-Licence header with the same licence text, plus Cache-Control: public, max-age=300. Errors are a plain { "error": "..." } body with the matching HTTP status (400, 404 or 503).
Licence
Derived signals, narratives and aggregates: CC BY 4.0 with attribution to breachcensus.com. Underlying regulator filings, court records and disclosures remain the property of their original publishers.
The derived material above (and the JSON/CSV export it’s served from) is under CC BY 4.0: reuse it freely with attribution to breachcensus.com.
Sources
HHS Office for Civil Rights breach portal · SEC EDGAR · state attorneys general (CA, WA, TX, MA, NH, VT) · UK Information Commissioner’s Office (ICO) · CNIL · FCA · PRA · CISA KEV / NVD · ransomware.live · RansomLook (CC BY 4.0)
This is automated reading of public filings, court records and disclosures, not legal advice. Every claim traces to a cited source document — verify anything load-bearing against the original.