Unknown
0 confirmed incidents.
VERIS: unknown:Unknown
Unknown is a regulator reporting category, not a MITRE ATT&CK technique: it is the label used when a source document, an HHS Office for Civil Rights breach-portal entry or a similar state breach-notification filing, does not state how the incident occurred, or states only that the cause had not yet been determined at the time of filing. Breach Census carries an incident under this classification rather than guessing at a more specific attack type; a later, more detailed source can move the same incident to a more specific classification if one becomes available.
No confirmed incidents currently carry this attack-type classification.
Questions and answers
How many confirmed incidents are classified as Unknown on Breach Census?
0 confirmed incidents are currently classified as Unknown.
Why doesn't the Unknown classification map to a MITRE ATT&CK technique?
Unknown is a regulator reporting category rather than an attacker technique -- it is used when a source document classifies an incident this way without specifying a technical method, so it has no MITRE ATT&CK id of its own.
What counts as a confirmed incident for the Unknown classification?
An incident counts here once it carries the Unknown attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.