Hacking/IT incident is a regulator reporting category, not a MITRE ATT&CK technique: it is the label the HHS Office for Civil Rights breach portal and similar state breach-notification forms use when a reporting organization checks the general "hacking incident" box without specifying the technique involved. Breach Census carries an incident under this classification when its source document uses this category and does not otherwise identify a more specific attack type from the list on this page; it is not itself a description of how the attacker got in.
How many confirmed incidents are classified as Hacking/IT Incident on Breach Census?
1,021 confirmed incidents are currently classified as Hacking/IT Incident.
Which organization has the most confirmed Hacking/IT Incident incidents?
Fieldtex Products, Inc., with 3 confirmed incidents classified this way.
Why doesn't the Hacking/IT Incident classification map to a MITRE ATT&CK technique?
Hacking/IT Incident is a regulator reporting category rather than an attacker technique -- it is used when a source document classifies an incident this way without specifying a technical method, so it has no MITRE ATT&CK id of its own.
What counts as a confirmed incident for the Hacking/IT Incident classification?
An incident counts here once it carries the Hacking/IT Incident attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.