Have I Been Pwned already considers data breaches in scope - it surprised me a bit that it reported things where my password wasn't at risk at all but my data was leaked and there was nothing I could do about it. (In particular there was one breach of data scraped from publicly available data from GitHub, where there was neither anything I could do about it nor anything I wanted to do about it.)

I think it's still keyed on email address though.