Breach Census
A global, entity-centred register of confirmed cyber attacks and data breaches, built from published regulator filings — US state attorneys general, HHS OCR, SEC EDGAR, ICO, CNIL, FCA/PRA — court records and company disclosures, with every confirmed incident backed by a citable source; leak-site claims are tracked separately and stay unverified until corroborated.
Organisations
Directory of every tracked organisation, paginated, with a confirmed-incident count and its own page per entity.
Sectors
Confirmed incident and organisation counts by sector, with a page per sector and per sector-year.
Countries
Organisation and confirmed-incident counts by country, with a page per country.
Years
Confirmed incidents by year, with fines, sector breakdowns and top jurisdictions per year.
Attack types
Confirmed incidents by attack type (MITRE ATT&CK / VERIS mapped), with a page per type.
Regulators
Data protection and financial regulators tracked, with published enforcement-action counts and a page per regulator.
States
US state breach-notification registers ingested on Breach Census, with a notice count and page per state.
Litigation
Incidents matched to exactly one CourtListener court docket, each linking to the filing.
Data types
Confirmed incidents by the type of personal data reported involved, with a definition, guidance and page per type.
Sources
The regulator filings, court records and other registers Breach Census cites, with a confirmed-incident count and page per register.
Statistics
Year-by-year totals, disclosure delays and fines across all confirmed incidents on file.
Was I affected?
Lookup and general guidance for confirmed incidents that meet a records-affected or regulator-action threshold.
Largest breaches
The 100 largest confirmed incidents on file, ranked by total records affected as reported by the source.
Recently disclosed
Confirmed incidents from the last 90 days, newest first.
Glossary
Plain-language definitions of the attack types, data types, regulators and confirmation levels used across the site.
Weekly report
Live current totals plus an archive of frozen weekly snapshot pages, one per published ISO week.
Developers
Free JSON and CSV API endpoints and a full dataset export, with licence terms.
About
What Breach Census is, who runs it, and links to the methodology and developer docs.
Methodology
The confirmation ladder, the claim-only rules, source list and a visible FAQ.
Contact
Contact address and the right-of-reply and correction process.
Privacy
How the site handles personal data — no accounts, no forms, hosting logs only.
Terms
Terms of use: read-only site, no warranties, and the data licence.
How Breach Census works
A confirmed incident on Breach Census is one where at least one event carries a self-report, regulator or court confirmation level — evidence stronger than a bare claim or a press report. Confirmation status, not an organisation’s size or a headline figure, decides whether an incident is treated as fact here.
That confirmed record is built from public regulator filings and court records — HHS OCR, SEC EDGAR, US state attorneys general, the ICO, CNIL, the FCA and PRA, and CourtListener — together with organisations’ own disclosures, with every confirmed incident and event carrying a citation back to its source document.
Ransomware and extortion group leak-site claims are tracked separately: reproduced as posted on the Threat groups page and labelled unverified, they never become a confirmed incident on their own. See Methodology for the full confirmation ladder and source list.
Frequently asked questions
What is Breach Census?
Breach Census is a global, entity-centred register of confirmed cyber attacks and data breaches, built from published regulator filings, court records and company disclosures, with every confirmed incident backed by a citable source.
How is an incident confirmed?
An incident's confirmed flag turns true once at least one event on it reaches self-report, regulator or court confirmation level — the three rungs above claim and press report on the confirmation ladder. A bare claim or press report alone is never enough.
How often is the data updated?
Most sources — including the state attorney general portals, HHS OCR, SEC EDGAR and the ICO — are ingested on a daily automated schedule; a handful of sources run weekly. The site is rendered dynamically, so a newly confirmed incident appears as soon as the next ingest run has processed it.
How do I correct an entry?
Email [email protected] with the page URL, what is wrong, and a source for the correction. See the Contact page for the full right-of-reply process.
How confirmation works
Every incident carries a confirmation_level on its evidence, ranked lowest to highest: claim (posted by a threat actor, unverified) < press (media reporting) < self_report (the organisation disclosed it) < regulator (a regulator opened an action) < court (a court filing). An incident is only marked confirmed — and only then eligible to appear indexed — once at least one event reaches self_report, regulator or court; claim- or press-only material is shown on the organisation’s page labelled as an unverified claim, never as a confirmed breach.
Every entity, incident and regulator action here is also available as free, machine-readable data with no key required — see Developers for the API endpoints, a full dataset export, and licence terms.