# Breach Census

> A global, entity-centred register of confirmed cyber attacks and data breaches, built from published regulator filings — US state attorneys general, HHS OCR, SEC EDGAR, ICO, CNIL, FCA/PRA — court records and company disclosures, with every confirmed incident backed by a citable source; leak-site claims are tracked separately and stay unverified until corroborated.

Corpus: 15,604 entities tracked; 23,211 confirmed incidents; 346 regulator actions; 34,216 unverified claims monitored. Data as of 2026-10-26.

## Machine-readable

- [Long-form version of this file](https://breachcensus.com/llms-full.txt)
- [Sitemap](https://breachcensus.com/sitemap.xml)
- [Atom feed of recently disclosed incidents](https://breachcensus.com/feed.xml)

## Pages

- [Home](https://breachcensus.com/): What Breach Census is, headline figures, and how incident confirmation works.
- [Organisations](https://breachcensus.com/org): Directory of every tracked organisation, paginated, with a confirmed-incident count and its own page per entity.
- [Sectors](https://breachcensus.com/sector): Confirmed incident and organisation counts by sector, with a page per sector and per sector-year.
- [Countries](https://breachcensus.com/country): Organisation and confirmed-incident counts by country, with a page per country.
- [Years](https://breachcensus.com/year): Confirmed incidents by year, with fines, sector breakdowns and top jurisdictions per year.
- [Attack types](https://breachcensus.com/attack-type): Confirmed incidents by attack type (MITRE ATT&CK / VERIS mapped), with a page per type.
- [Regulators](https://breachcensus.com/regulator): Data protection and financial regulators tracked, with published enforcement-action counts and a page per regulator.
- [States](https://breachcensus.com/state): US state breach-notification registers ingested on Breach Census, with a notice count and page per state.
- [Litigation](https://breachcensus.com/litigation): Incidents matched to exactly one CourtListener court docket, each linking to the filing.
- [Data types](https://breachcensus.com/data-type): Confirmed incidents by the type of personal data reported involved, with a definition, guidance and page per type.
- [Sources](https://breachcensus.com/source): The regulator filings, court records and other registers Breach Census cites, with a confirmed-incident count and page per register.
- [Statistics](https://breachcensus.com/stats): Year-by-year totals, disclosure delays and fines across all confirmed incidents on file.
- [Was I affected?](https://breachcensus.com/was-i-affected): Lookup and general guidance for confirmed incidents that meet a records-affected or regulator-action threshold.
- [Largest breaches](https://breachcensus.com/largest): The 100 largest confirmed incidents on file, ranked by total records affected as reported by the source.
- [Recently disclosed](https://breachcensus.com/recent): Confirmed incidents from the last 90 days, newest first.
- [Glossary](https://breachcensus.com/glossary): Plain-language definitions of the attack types, data types, regulators and confirmation levels used across the site.
- [Weekly report](https://breachcensus.com/report): Live current totals plus an archive of frozen weekly snapshot pages, one per published ISO week.
- [Developers](https://breachcensus.com/developers): Free JSON and CSV API endpoints and a full dataset export, with licence terms.
- [About](https://breachcensus.com/about): What Breach Census is, who runs it, and links to the methodology and developer docs.
- [Methodology](https://breachcensus.com/methodology): The confirmation ladder, the claim-only rules, source list and a visible FAQ.
- [Contact](https://breachcensus.com/contact): Contact address and the right-of-reply and correction process.
- [Privacy](https://breachcensus.com/privacy): How the site handles personal data — no accounts, no forms, hosting logs only.
- [Terms](https://breachcensus.com/terms): Terms of use: read-only site, no warranties, and the data licence.

## How confirmation works

claim < press < self_report < regulator < court — an incident is marked confirmed, and only then indexed, once at least one event reaches self_report, regulator or court; a bare claim or press report never confirms one on its own. Full ladder, per-source list and FAQ: https://breachcensus.com/methodology.

## API

- https://breachcensus.com/api/register: paginated JSON entity register, filterable by country and sector.
- https://breachcensus.com/api/register.csv: the same register, unpaginated, as a CSV download (capped at 50,000 rows).
- https://breachcensus.com/api/org/{slug}: one organisation — identity, incidents, event timeline, regulator actions, litigation summary.
- https://breachcensus.com/api/incident/{id}: one incident — facts, its organisation, event timeline, regulator actions.
- https://breachcensus.com/api/health: health check, 200 with { ok: true, db: true } when the database is reachable, 503 otherwise.
- All endpoints are free, open-CORS GET requests — see https://breachcensus.com/developers for full documentation.
- Licence: Derived signals, narratives and aggregates: CC BY 4.0 with attribution to breachcensus.com. Underlying regulator filings, court records and disclosures remain the property of their original publishers.

## Unverified / empty surfaces (linked, not indexed)

- [Threat groups](https://breachcensus.com/group) (reason: claim-only): Ransomware/extortion group leak-site claims, reproduced as posted — unverified, noindex by design.
- [Vendors](https://breachcensus.com/vendor) (reason: empty): Vendor blast-radius pages — no incident_vendor_link rows yet, noindex by design until populated.

[AI usage policy](https://breachcensus.com/ai.txt)