Glossary

Plain-language definitions for the terms used across the site. See Methodology for the full confirmation ladder and source list.

This page defines the vocabulary used everywhere else on the site: the attack-type classifications used to tag an incident, the categories a reported data type can fall into, the regulators tracked, and the five-rung confirmation ladder that decides whether an incident is shown as confirmed. None of these definitions changes what a source document actually said — they describe how this site groups and labels what a source reported, not a claim on their own.

Attack types (26)

Every attack-type classification tracked, each mapped to MITRE ATT&CK technique IDs and, where available, a VERIS category. See Attack types for incident counts per type.

Backup DestructionMITRE ATT&CK: T1561, T1490 · VERIS: malware:Destroy data
Cloud Storage BreachMITRE ATT&CK: T1530, T1526 · VERIS: hacking:Exploit misconfig
Code InjectionMITRE ATT&CK: T1190, T1202 · VERIS: hacking:XPath injection
Credential TheftMITRE ATT&CK: T1110, T1187, T1056 · VERIS: malware:Password dumper
Data DestructionMITRE ATT&CK: T1561, T1565, T1485 · VERIS: hacking:Exploit vuln
Data ExfiltrationMITRE ATT&CK: T1020, T1041, T1567, T1213 · VERIS: hacking:Use of stolen creds
Data InterceptionMITRE ATT&CK: T1557, T1020 · VERIS: hacking:AitM
Denial of ServiceMITRE ATT&CK: T1498, T1499 · VERIS: hacking:DoS
Hacking/IT IncidentNo MITRE ATT&CK mapping yet · VERIS: hacking:Unknown
Improper DisposalNo MITRE ATT&CK mapping yet · VERIS: error:Disposal error
Lateral MovementMITRE ATT&CK: T1570, T1021 · VERIS: hacking:Use of stolen creds
LossNo MITRE ATT&CK mapping yet · VERIS: error:Loss
Malware DeploymentMITRE ATT&CK: T1566, T1199 · VERIS: malware:Trojan
Phishing AttackMITRE ATT&CK: T1566, T1598 · VERIS: social:Phishing
Privilege Abuse (Insider)MITRE ATT&CK: T1078, T1087 · VERIS: misuse:Privilege abuse
Privilege EscalationMITRE ATT&CK: T1548, T1134, T1547 · VERIS: hacking:Exploit vuln
Ransomware AttackMITRE ATT&CK: T1486, T1490, T1561 · VERIS: malware:Ransomware
SQL InjectionMITRE ATT&CK: T1190 · VERIS: hacking:SQLi
Session HijackingMITRE ATT&CK: T1185, T1040 · VERIS: hacking:Session fixation
Social EngineeringMITRE ATT&CK: T1597, T1598 · VERIS: social:Pretexting
Supply Chain CompromiseMITRE ATT&CK: T1195, T1199 · VERIS: hacking:Exploit vuln
TheftNo MITRE ATT&CK mapping yet · VERIS: physical:Theft
Unauthorized Access/DisclosureNo MITRE ATT&CK mapping yet · VERIS: misuse:Privilege abuse
UnknownNo MITRE ATT&CK mapping yet · VERIS: unknown:Unknown
Unsecured CredentialsMITRE ATT&CK: T1552, T1526 · VERIS: error:Misconfiguration
Web Application ExploitationMITRE ATT&CK: T1190, T1133 · VERIS: hacking:Exploit vuln

Data types

The categories an incident’s reported data types can fall into. Four of the ten (address, date of birth, name, other) have no incident-specific guidance step on a Was I affected? page beyond the generic advice every incident already shows; the other six do.

ssnA US Social Security number.
financial-accountA bank account or payment card number.
drivers-licenseA driver’s license (or equivalent) number.
government-idA passport or other government-issued identity document number.
medicalMedical records or treatment information.
health-insuranceHealth insurance policy or claims information.
addressA home or mailing address. (no incident-specific guidance step)
dobDate of birth. (no incident-specific guidance step)
nameA full name. (no incident-specific guidance step)
otherA data type reported by the source that does not map to one of the categories above. (no incident-specific guidance step)

Regulators (24)

Data protection and financial regulators tracked. See Regulators for published enforcement-action counts per regulator.

Confirmation levels

The five confirmation levels, in ascending order of certainty. See Methodology for the full confirmation ladder, including which levels actually confirm an incident.

ClaimA ransomware group’s own leak-site listing. Reproduced as posted, never treated as fact.
Press reportedA news outlet reported the incident, with no self-report, regulator filing or court record yet.
Self reportThe organisation itself disclosed the incident. Confirms the incident.
RegulatorA data-protection or financial regulator took or published an action tied to the incident. Confirms the incident.
CourtA court record ties litigation to the incident. Confirms the incident.

Questions and answers

What is the difference between a claim and a confirmed incident?

A claim is a ransomware or extortion group's own leak-site listing, reproduced as posted and never treated as fact. An incident is confirmed only once at least one event on it reaches self report, regulator or court — three rungs higher than claim or press reported on the confirmation ladder.

What does 'records affected' cover?

'Records affected' on an organisation or incident page is the organisation's own reported total for that incident. A US state attorney general notice instead reports residents of just that one state who were notified — a narrower figure kept in a separate field and never summed into records affected.

What does a data type mean here?

A data type is one of the categories an incident's reported data types can fall into — for example a Social Security number or a driver's license number. Six of the ten categories carry an extra guidance step on a Was I affected? page; the other four (address, date of birth, name, other) do not.

Why does an attack type sometimes have no MITRE ATT&CK mapping?

Not every attack-type classification tracked here has been mapped to a MITRE ATT&CK technique ID yet. Where none exists yet, the page shows 'No MITRE ATT&CK mapping yet' instead of guessing one.