Breach Census
A global, entity-centred register of confirmed cyber attacks and data breaches, built from published regulator filings — US state attorneys general, HHS OCR, SEC EDGAR, ICO, CNIL, FCA/PRA — court records and company disclosures, with every confirmed incident backed by a citable source; leak-site claims are tracked separately and stay unverified until corroborated.
Latest confirmed
- Frontline EducationOctober 27, 2026
- BCD Travel USA LLCOctober 27, 2026
- Chisholm, Persson & Ball, P.C.October 26, 2026
- Westmark Enterprises Inc.October 26, 2026
- Alpha Omega Alpha Honor Medical SocietyOctober 26, 2026
- Betz Industries, Inc.October 26, 2026
- Lumara Bio USA, Inc.October 26, 2026
- Comprehensive Orthopaedics & Musculoskeletal Care, LLCOctober 26, 2026
See all recentLast 90 days
How Breach Census works
A confirmed incident on Breach Census is one where at least one event carries a self-report, regulator or court confirmation level — evidence stronger than a bare claim or a press report. Confirmation status, not an organisation’s size or a headline figure, decides whether an incident is treated as fact here.
That confirmed record is built from public regulator filings and court records — HHS OCR, SEC EDGAR, US state attorneys general, the ICO, CNIL, the FCA and PRA, and CourtListener — together with organisations’ own disclosures, with every confirmed incident and event carrying a citation back to its source document.
Ransomware and extortion group leak-site claims are tracked separately: reproduced as posted on the Threat groups page and labelled unverified, they never become a confirmed incident on their own. See Methodology for the full confirmation ladder and source list.
How confirmation works
Every incident carries a confirmation_level on its evidence, ranked lowest to highest:
- 1Claim
claim(posted by a threat actor, unverified) - 2Press report
press(media reporting) - 3Self-report
self_reportconfirmed (the organisation disclosed it) - 4Regulator
regulatorconfirmed (a regulator opened an action) - 5Court
courtconfirmed (a court filing)
An incident is only marked confirmed — and only then eligible to appear indexed — once at least one event reaches self_report, regulator or court; claim- or press-only material is shown on the organisation’s page labelled as an unverified claim, never as a confirmed breach.
Largest on record
- Change Healthcare Inc.October 14, 2025192,700,000records
- Conduent Business Services, LLC (revised submission)May 20, 202662,486,662records
- Conduent Business Services LLCOctober 8, 202562,224,658records
- DriveWealthSeptember 30, 202630,000,000records
- Aflac IncorporatedDecember 22, 202522,653,844records
Browse the register
- OrganisationsDirectory of every tracked organisation, paginated, with a confirmed-incident count and its own page per entity.
- SectorsConfirmed incident and organisation counts by sector, with a page per sector and per sector-year.
- CountriesOrganisation and confirmed-incident counts by country, with a page per country.
- YearsConfirmed incidents by year, with fines, sector breakdowns and top jurisdictions per year.
- Attack typesConfirmed incidents by attack type (MITRE ATT&CK / VERIS mapped), with a page per type.
- RegulatorsData protection and financial regulators tracked, with published enforcement-action counts and a page per regulator.
- StatesUS state breach-notification registers ingested on Breach Census, with a notice count and page per state.
- LitigationIncidents matched to exactly one CourtListener court docket, each linking to the filing.
- Data typesConfirmed incidents by the type of personal data reported involved, with a definition, guidance and page per type.
- SourcesThe regulator filings, court records and other registers Breach Census cites, with a confirmed-incident count and page per register.
- StatisticsYear-by-year totals, disclosure delays and fines across all confirmed incidents on file.
- Was I affected?Lookup and general guidance for confirmed incidents that meet a records-affected or regulator-action threshold.
- Largest breachesThe 100 largest confirmed incidents on file, ranked by total records affected as reported by the source.
- Recently disclosedConfirmed incidents from the last 90 days, newest first.
- GlossaryPlain-language definitions of the attack types, data types, regulators and confirmation levels used across the site.
- Weekly reportLive current totals plus an archive of frozen weekly snapshot pages, one per published ISO week.
- DevelopersFree JSON and CSV API endpoints and a full dataset export, with licence terms.
- AboutWhat Breach Census is, who runs it, and links to the methodology and developer docs.
- MethodologyThe confirmation ladder, the claim-only rules, source list and a visible FAQ.
- ContactContact address and the right-of-reply and correction process.
- PrivacyHow the site handles personal data — no accounts, no forms, hosting logs only.
- TermsTerms of use: read-only site, no warranties, and the data licence.
Frequently asked questions
What is Breach Census?
Breach Census is a global, entity-centred register of confirmed cyber attacks and data breaches, built from published regulator filings, court records and company disclosures, with every confirmed incident backed by a citable source.
How is an incident confirmed?
An incident's confirmed flag turns true once at least one event on it reaches self-report, regulator or court confirmation level — the three rungs above claim and press report on the confirmation ladder. A bare claim or press report alone is never enough.
How often is the data updated?
Most sources — including the state attorney general portals, HHS OCR, SEC EDGAR and the ICO — are ingested on a daily automated schedule; a handful of sources run weekly. The site is rendered dynamically, so a newly confirmed incident appears as soon as the next ingest run has processed it.
How do I correct an entry?
Email [email protected] with the page URL, what is wrong, and a source for the correction. See the Contact page for the full right-of-reply process.
Every entity, incident and regulator action here is also available as free, machine-readable data with no key required — see Developers for the API endpoints, a full dataset export, and licence terms.