Why the Incident Record Is Mostly American

This method file sets out why an incident in one country enters the public record and an equivalent incident in another does not.

Mandatory breach notification with defined triggers and public filing is not universal. Where it does not exist, disclosure is voluntary, and organisations that suffer incidents rarely volunteer.

The healthcare register at 25-0630 is the clearest demonstration: a sector produces 343 filings in six months because it is compelled to, while equivalently affected sectors produce nothing.

The 1,900 US class actions at 25-1228 generate court filings, settlement notices and legal reporting — a substantial secondary record built on top of the notification.

Jurisdictions without collective redress produce a notification and then silence, so an incident of identical severity leaves a fraction of the documentary trace.

Much of this corpus rests on vendor research, leak-site monitoring and threat intelligence — commercial activity concentrated where the customers are.

A leak-site listing naming a company in a market those vendors sell into gets written up. One naming a company elsewhere frequently does not, which is why the file at 25-0528 has a group name, a month and nothing else.

This desk reports in English and reads sources in English. An incident covered thoroughly in Japanese, Hindi or Bahasa Indonesia is invisible to this corpus unless somebody translates it.

That is the plainest limitation of all and the one least often stated by databases of this kind.

Each filter individually is defensible. Together they mean the world’s incident record is approximately the incident record of the jurisdictions that legislate disclosure, litigate breaches, host security vendors and publish in English.

The correct inference from a sparse national record is that the country lacks the four filters, not that it lacks incidents. Nothing in this corpus should be read as evidence about relative national exposure.