Sources

What BreachGraph collects, and how fresh it is

As of 21 October 2026, 23:41 UTC · built from our collector and archive records

BreachGraph builds on public records: regulators’ breach registers and notices, SEC filings, leak-site postings, court records and vulnerability catalogs. Here is each source, what we hold, how often we check it and when a check last succeeded, including the ones we hold but don’t yet check on a schedule.

Freshness has three clocks

1. Collection. How soon a new record reaches BreachGraph. It is listed for each source below.
2. Review. An analyst checks new evidence before it changes a custody path or a count. We’ll publish this time once we measure it.
3. Release. Published counts change only in a dated release, like the 19 October MOVEit release.

Our goal is for a new filing, leak-site posting or court record to reach the custody and count records it touches within hours. Collection already runs at that pace for the 6 sources marked Live.

Checked on a schedule

Live means we check at least hourly and a check succeeded in the six hours before this page was built. A longer schedule means a check succeeded within its interval, allowing at least six hours. Not confirmed means a schedule is set up but we have no recent successful run on record.

Being added now

Started 21 October 2026, in priority order. Each source moves into the tables above once its collector has a confirmed scheduled run.

1. Daily checks for the 16 state registers we hold but don’t yet check, and confirmed runs for Massachusetts and Nebraska. Starting with the states that publish the notice letters themselves, because a letter names the vendor. Maine's and Maryland's sites are offline and Illinois blocks automated reading; those follow when they can be read.
2. CISA and FBI advisories. Joint cybersecurity advisories and FBI alerts, which often name a campaign and the software it exploits before the victims are known.
3. Vendor security advisories. Advisories from the makers of software exploited in breach campaigns, such as Progress, PTC and Oracle, where a campaign usually surfaces first.
4. New data-breach class-action complaints. A daily search for newly filed complaints, which often name the vendor within days of a breach notice. Today we collect only the cases we already follow.
5. More ransom-payment wallets. Wallets as they appear in court records, sanctions listings and public disclosures, each watched for new transactions.
6. MITRE ATT&CK updates. We hold a one-time copy of ATT&CK’s threat groups and the techniques and software they use (version 19.2, taken 15 September). A weekly check will pick up each new release, starting with version 20 of 13 October.
7. A second leak-site source. A second aggregator beside RansomLook, to cross-check first-seen dates and keep collecting if one source slows.

Optional: Real-time internet scan data, on request. Scans showing which internet-facing systems run newly exploited software, for clients who need exposure evidence while a campaign unfolds.

How fast leak-site postings arrive

In the last 30 days, BreachGraph captured 1,115 new postings a median of 10 minutes after RansomLook first listed them: 82% within an hour and 92% within a day. All 24 Cl0p postings arrived within an hour.

The slowest week was the week of 12 October, when 54% arrived within an hour. The leak-site collector started on 14 September, so earlier postings were gathered after the fact. The clock starts when RansomLook lists a posting, which can be later than the group’s own publication; RansomLook’s times are read as Luxembourg local time. Weeks start on Monday.

Held, not yet checked on a schedule

We hold these registers and the notices they link to, but don’t yet check them on a verified schedule. The date is the newest entry we hold, so anything filed after it isn’t here yet.

Across the 20 state regulators on this page, we hold 102,654 register entries and 69,086 notices. Register entries are rows in each regulator’s list, not unique breaches: one breach often appears in several states.

Added case by case

• Researcher-published scan data, such as Ken Buckler's lists of internet-facing MOVEit servers.
• Records requests to regulators, such as Maryland's 2020–21 breach-notice archive (3,445 files).
• Company statements, settlement administrators' records and court orders behind specific findings.

What these figures don’t say

• A schedule can still miss a quiet change. Where a source allows it, each check re-reads the whole register rather than only new rows, as for HHS and California.
• Collection is not review. A new record changes a custody path or a count only after an analyst checks it.
• Sources not listed here aren’t monitored. If you need one, name it when you request early access.

Times are UTC. This page is rebuilt from the records it describes; see the roadmap for what comes next.