breach_news
Read recent breach and ransomware DISCLOSURES from public threat-intel feeds (HaveIBeenPwned, the RansomLook live leak-site tracker and SEC 8-K Item 1.05 filings), newest first. Every row is metadata only — entity, date, scale, exposed data TYPES, threat level and source — never the leaked data, and a redaction pass strips anything credential-shaped before it is returned. Use sector to narrow to an industry keyword; for one specific organization use check_exposure; for all-time history use breach_history.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | maximum disclosures to return (default 10; raise it deliberately, large pages are heavy for an agent loop) | |
| offset | No | how many matching disclosures to skip before the page starts; with limit this walks a result set larger than any single page (count reports the full total) | |
| sector | No | optional keyword filter over entity, title, summary, categories and exposed data types, e.g. 'bank', 'health', 'crypto' | |
| source | No | optional source filter: 'HaveIBeenPwned', 'RansomLook', 'ransomwatch-archive' or 'SEC EDGAR 8-K 1.05' | |
| since_days | No | look-back window in days over disclosure dates (default 30) |