Sources

Where the records come from

BreachRecords reads free public sources: the breach portal of the U.S. Department of Health and Human Services (HHS) Office for Civil Rights, cybersecurity incident disclosures filed with the Securities and Exchange Commission (SEC) on Form 8-K under Item 1.05, and the breach notice lists state attorneys general publish. Each source is listed here with its license, the attribution it asks for, the permissions recorded for it, the dates its records cover and its last successful run.

Company filings

SEC Form 8-K Item 1.05 (material cybersecurity incidents) Live

Publisher: U.S. Securities and Exchange Commission · https://www.sec.gov/edgar/search/
Format: sgml/html, read daily
License: Public; cite sec.gov (terms)
Attribution: Source: U.S. Securities and Exchange Commission (sec.gov)
Permissions: Derived facts may be published; archived copies stay in the private archive (decided Oct. 19, 2026).
Records dated: No records loaded
Last successful run: None yet

Regulator portals

HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Live

Publisher: U.S. Department of Health and Human Services, Office for Civil Rights · https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
Format: csv, read daily
License: U.S. government work
Attribution: Source: U.S. Department of Health and Human Services, Office for Civil Rights breach portal
Permissions: Derived facts may be published; archived copies stay in the private archive (decided Oct. 19, 2026).
Records dated: No records loaded
Last successful run: None yet

How a source is read

Each run fetches the source's published file or page, stores the exact bytes in the evidence archive under their SHA-256 hash, and parses the archived bytes. A record whose content differs from its previous occurrence gets a new revision; the earlier revision stays. Every public statement on this site traces to a revision and to the archived document it was parsed from. The methodology has the details.