Have I Been Pwned offers a subscription to monitor domains for data leaks

Have I Been Pwned is launching a subscription system that allows large companies to check whether email domains have been involved in a data breach. A free variant remains available that allows up to ten compromised email addresses.

Until now, looking up an email address in the database of twelve billion records was completely free, even for parties who wanted to check an entire domain. HIBP founder Troy Hunt writes on the other hand, specific domain searches are very expensive. That’s why he wants companies to pay for bulk searches from now on.

Domains with up to ten email addresses pwned can still use the service for free. That would be 60 percent of all domains within the HIBP database. The remaining 40 percent, divided into categories of 10 percent of all domains each, will have to pay roughly $4, $17, $29 or $115 per month per month for listing a certain number of leaked email addresses per month, depending on the subscription.

On the updated domain search page states that customers must first prove that they manage a specified domain, after which they can access a special dashboard. Here they can view the data provided. Customers receive an email notification when new email addresses within the specified domain appear in a new database. HIBP also offers customers a domain search API, which works slightly differently than the public API for regular email addresses.

In the terms of use, HIBP says that there is a special arrangement for what it calls ‘domain creep’. In principle, customers are entitled to the listing of a limited number of ‘breached addresses’. If new email addresses appear in data breaches and would actually fall outside the current plan, customers will have until the next billing date to upgrade the plan.

*No euro prices have been announced yet.