Methodology

How the records are made

BreachRecords lists what public sources state, attributed to the source that stated it. The sources are the breach portal of the U.S. Department of Health and Human Services (HHS), cybersecurity incident disclosures filed with the Securities and Exchange Commission (SEC) and the breach notice lists state attorneys general publish. This page describes the record classes, the counting units, how an organization is matched, the review every record passes and how corrections work.

Record classes

Every record belongs to one class, shown as a label on the record. The classes are counted apart and never added together.

• Regulator-posted notice. A breach report a regulator posted: an entry on the HHS breach portal or on a state attorney general's list. The regulator posts what the reporting organization submitted.
• Company-disclosed incident. A cybersecurity incident the company itself disclosed in a Form 8-K filed with the SEC under Item 1.05.
• Leak-site claim. A post on a leak site that a tracker recorded. Claims are a later addition to the site. A claim stays a claim: it is listed under its own heading, carries the claim label and never changes the status of a notice or a disclosure.

What a record states

A source record is what a source said. A revision is what it said at one time: when the same entry changes at the source, a new revision is kept beside the earlier one. An incident is a reviewer's grouping of source records about one event. Every fact on an incident page names the revision it came from and the archived document that revision was parsed from. Category words are the source's own words, quoted as written, such as the HHS category "Hacking/IT Incident" or a filing's "cybersecurity incident".

Figures and counting units

Every figure is the source's figure, shown with the source, the basis the source gave (a total, or residents of the reporting state) and the date of the revision it came from. When two sources report different figures for one incident, both are shown. Figures are never summed, averaged or chosen between. When a source revises a figure, the new figure is shown and the earlier one is marked superseded with its date.

The headline counts on the home page count distinct approved records by class. An organization page lists the records naming the organization with the role each source gave it, and carries no per-organization total.

Dates

Each record shows two kinds of date apart: the source date, which is the date the source gives (a submission date on the HHS portal, a filing date at the SEC, a notice date on a state list), and the observation date, which is when BreachRecords recorded the revision. Dates an organization reported inside a notice (the incident dates, the discovery date) are shown as reported and labeled as such.

Organizations and matching

Organizations come from a shared directory built from public registries: SEC company tickers and submissions, Wikidata, the Integrated Postsecondary Education Data System (IPEDS) and others listed on the sources page. Matching only ranks candidates. A company filing is matched by its SEC Central Index Key (CIK). A regulator-posted notice is matched by the normalized name and the reporting jurisdiction. In every case a reviewer confirms the organization and the role before the record is listed.

A notice that names an organization absent from the directory is listed, after review, under the name as filed with the label "Provisional: identity as filed, not yet matched to the directory". A provisional organization is never attached to an existing directory entry by name similarity. When a reviewer later merges it into a directory entry, the old address redirects and every record that pointed at it is reviewed again.

Review before publication

Nothing is public without a reviewer's approval recorded in the database. An approval pins the content it covered: the revisions, the figures and the organization mapping. If any of those change, through a new revision at the source, a merge or a relink, the record drops out of the approved state and the site shows the last approved version with the note "Source updated, under review" until a reviewer approves it again. There is no automatic publication.

Evidence and chain of custody

Every fetched document is stored under the SHA-256 hash of its exact bytes, written once and never overwritten. Each fetch has its own acquisition record: the requested URL, the final URL, the time, the response status and the fetcher version. Parsing reads the archived bytes. A record page links to our archived copy first and to the source's page second. Archived copies are served only where the source's terms allow it and a permission decision is recorded; otherwise the page shows the hash and links to the source. Archived HTML is served as a download and is never rendered on this site.

Corrections, disputes and suppression

Every organization and incident page carries a free correction form. We acknowledge every request within two business days. A credible report of a wrong identity, or a sensitive document, can be suppressed at once while the review runs; the record disappears from every page and the audit history is kept. A less urgent dispute shows the state "Disputed, under review" without amending the record. Corrections keep history: the page says what changed and when, and superseded revisions stay in the private archive. Requests to remove a whole profile go to the owner for a decision; the default is to correct and annotate.

Coverage

The home page and the sources page state, for each source, the dates its records cover and the last successful run. An empty list reads "No records found in the sources and dates covered" followed by those sources and dates. It describes what these sources hold for those dates and nothing beyond them.

Records reflect source filings as of the dates shown. BreachRecords is not a regulator.