Sources. Headlines from BleepingComputer, The Record, CyberScoop, Dark Reading, SecurityWeek, The Hacker News, KrebsOnSecurity and DataBreaches.net (title, link and date only — ICHI never copies article text); SEC Form 8-K Item 1.05 filings; ransomware leak-site posts via ransomware.live and ransomlook (victim and group only, never linked).
What a status means. “Confirmed — regulatory filing”: the organisation’s own regulatory disclosure, read first-hand (an SEC Form 8-K Item 1.05, or a breach notification filed with the Washington, Delaware or California Attorney General). “Reported”: a newsroom reported it; “victim statement” means the report relays the victim’s own words, which ICHI has not read first-hand. “Actor claim — unverified”: an attacker’s post, not evidence that an attack happened. Filings by one organisation are one source, however many amendments it files. Victims’ countries are never shown.
Government sources. Washington data breach notifications: Washington State Attorney General’s Office, Consumer Protection Division, published on data.wa.gov (notices ). A notification states that the organisation notified the Attorney General of a breach affecting more than 500 Washington residents; its date is the notice date, not when the breach began. Rows filed as “theft or mistake” are not listed. Delaware data security breach notifications: Delaware Department of Justice, Office of the Attorney General, published on data.delaware.gov ; Delaware records no cause, so a Delaware notice is listed as a breach notification and never as a cyberattack, ransomware or an actor. California data security breach reports: State of California Department of Justice, Office of the Attorney General, from the official breach report list ; a report states that the organisation reported a breach affecting more than 500 California residents, its date is the reported date, and California records no cause, so it is listed as a breach notification, never as a cyberattack, ransomware or an actor. When two regulators’ notices by one organisation state the same breach start date they are one incident; different stated dates are kept apart. SEC filings: U.S. Securities and Exchange Commission, EDGAR.
Significance is what the headline itself states: a government or critical-service target, millions affected or a loss of $10M+ weigh most; a service disruption less. Then the number of outlets, the evidence and recency. Data: archive months .