# BreachRecords

> Breach notices posted by regulators (the HHS breach portal, state attorney general
> lists) and cybersecurity incidents disclosed by companies (SEC Form 8-K Item 1.05),
> listed per organization from public records. Each record names the source that
> published it, the source's own date and the date BreachRecords observed it.

Record classes: regulator-posted notice and company-disclosed incident. The two
classes carry their own labels and are counted apart. Leak-site claims are a later
addition and stay apart from both.

Figures: every number is the source's number, shown with the source, the basis the
source gave and the revision date. When two sources report different figures, each
is shown. Figures are not summed, averaged or chosen between.

Publication: a record appears only after a reviewer approved it. A record whose
source has changed since approval shows the last approved version with the note
"Source updated, under review" until it is reviewed again.

Absence: "No records found in the sources and dates covered" states what these
sources hold for the dates listed on /sources. It says nothing about events outside
those sources and dates.

Pages: / (search and recent records), /org/<slug>, /incident/<slug>,
/evidence/<sha256> and /evidence/<sha256>/about, /sources, /methodology,
/how-we-report, /about, /contact, /legal/terms, /legal/privacy.

Corrections: every organization and incident page carries a correction form.
BreachRecords is operated by BreachScout and is not a regulator.