Unauthorized access/disclosure is a regulator reporting category, not a MITRE ATT&CK technique: it is the label used on the HHS Office for Civil Rights breach portal and similar state breach-notification forms for an incident where someone not authorized to see or use certain data did so, including a case where an authorized user accessed or sent data beyond what their role permitted, with no external attacker involved at all. Because it can describe either internal misuse or an external party viewing data through a permissions failure, it is deliberately broader than any single MITRE ATT&CK technique.
How many confirmed incidents are classified as Unauthorized Access/Disclosure on Breach Census?
463 confirmed incidents are currently classified as Unauthorized Access/Disclosure.
Which organization has the most confirmed Unauthorized Access/Disclosure incidents?
Apro, LLC d/b/a United Pacific (Apro), with 2 confirmed incidents classified this way.
Why doesn't the Unauthorized Access/Disclosure classification map to a MITRE ATT&CK technique?
Unauthorized Access/Disclosure is a regulator reporting category rather than an attacker technique -- it is used when a source document classifies an incident this way without specifying a technical method, so it has no MITRE ATT&CK id of its own.
What counts as a confirmed incident for the Unauthorized Access/Disclosure classification?
An incident counts here once it carries the Unauthorized Access/Disclosure attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.