Daily data breach monitoring for key email accounts

Every weekday morning at 8am, run this as a deterministic code workflow that monitors a watchlist of high-value email addresses (executives, shared mailboxes, and the personal accounts your leaders use for work) against Have I Been Pwned and records any breach exposure to a Google Sheet. Use a cron trigger. Have I Been Pwned is not a webhook or poll source, and keeping the watchlist in a Sheet lets it be edited without changing the workflow.

Start by reading the watchlist. Use Google Sheets Get Values to read the email addresses from the 'Watchlist' tab (one address per row, for example column A). Then read the existing log with Get Values on the 'Log' tab so you have every email and breach name that has already been recorded, and build a lookup of these previously logged pairs so you can tell new findings from ones already on file.

For each email address, look it up in Have I Been Pwned. Call Get Breaches for Account (request the full breach model with truncateResponse=false so you get the breach date and data classes, not just the name) and Get Pastes for Account. URL-encode the email in the path. Treat a 404 response as 'clean, no results' rather than an error, and simply move on to the next address.

For every breach and paste returned, append one row to the 'Log' tab with Append Values. Each row should contain the email address, the breach name, the breach date (BreachDate, in YYYY-MM-DD form), the exposed data classes (the DataClasses list joined into a readable string), whether the finding is new (yes if the email and breach name were not already in the log, no otherwise), and the date the check ran.

Finally, for each brand-new breach (one whose email and breach name were not already in the log), send an alert to the security channel with Slack Bot's Send a Message. Include the monitored email address, the breach name, the breach date, and the exposed data classes so the security team can act. Do not alert on breaches that were already recorded in the log. Only newly appeared breaches should trigger a message.