Glossary

A phone call, not an email, used to talk somebody into granting access.

Phishing conducted by voice. The caller impersonates a colleague or IT support and persuades a real employee to reset a password, enrol a new authentication device, or read out a code. It defeats multi-factor authentication without breaking it: the factor is handed over rather than bypassed. It is the dominant initial-access route across this corpus.

A message designed to make the recipient hand over credentials or run something.

A message — usually email — crafted to look legitimate enough that the recipient enters a password, approves a prompt, or opens an attachment. The oldest technique in the set and still among the most effective, because it targets the person rather than the system.

A second proof of identity beyond the password.

A second check on top of a password — a code, a push notification, a hardware key. It raises the cost of a stolen password considerably, and it does nothing at all if the attacker persuades a help desk to enrol their own device as the second factor, which is what repeatedly happens in these files.

One login that opens many systems.

A central identity service that authenticates a user once and then vouches for them to every connected application. Efficient, and a concentration of risk: one compromised account reaches everything the account was entitled to, which is usually far more than the intruder needed.

Turning limited access into powerful access.

Moving from the permissions an account legitimately holds to greater ones, whether by exploiting a flaw or by finding credentials lying somewhere the account could already read. Several files here note that no escalation was necessary: ordinary read access was enough.

Spreading sideways through a network after the first foothold.

Using access on one machine or account to reach others. It is the phase where an intrusion becomes an incident, and the phase most likely to be missed, because it often looks exactly like normal administration.

Manipulating a person instead of a system.

Persuasion used as an attack technique: pretexting, urgency, impersonation. The corpus records that an unsophisticated technique which works is worse than a sophisticated one, because it is available to far more people.

Trying passwords stolen elsewhere against a different service.

Automated reuse of username and password pairs from earlier breaches, exploiting the fact that people reuse passwords. It requires no flaw in the target at all.

Malware that harvests saved passwords and session cookies from a machine.

Software that scrapes credentials, browser cookies and tokens from an infected computer and sells them on. It supplies much of the raw material for later intrusions, often from a personal device that never touched the corporate network.

A pass that proves you already logged in — and works without the password.

A credential issued after authentication so a user is not asked to log in repeatedly. Stolen, it grants access without the password and usually without triggering multi-factor authentication, because from the system’s view the login already happened.

Whatever proves you are allowed in — usually a username and password.

Authentication material: passwords, keys, tokens, certificates. A stolen credential produces an intrusion that looks entirely legitimate from the inside, which is why it generates so much less documentation than an exploited vulnerability and is under-represented in this database as a result.

The first foothold — how the intruder got in at all.

The opening move, before any movement or theft. Across this corpus it is far more often a person granting access than a system being broken.

Software written to do harm.

A catch-all for hostile code: ransomware, infostealers, remote-access tools. Note how often the files here involve none of it — legitimate remote-support software and valid credentials do the same work and raise fewer alarms.

Software that encrypts an organisation’s files and demands payment to unlock them.

Malicious software that renders data unusable until a ransom is paid. Modern operations pair encryption with data theft so that refusing to pay still carries a threat of publication — see double extortion.

Encrypt the data and threaten to publish it, so backups are not a full answer.

The standard model since roughly 2020: steal the data before encrypting it, then demand payment both to restore access and to suppress publication. An organisation with perfect backups still faces the second demand, which is why good recovery no longer removes the incentive to pay.

The public page where an extortion group names organisations that have not paid.

A site, usually on Tor, where a group publishes the names of victims and samples of stolen data. It is an extortion instrument rather than a record: an organisation appears because it did not pay, or paid late, or because listing it pressures somebody else. This corpus treats leak-site counts as a measure of publication, not of compromise.

A franchise: operators supply the tooling, affiliates carry out the attacks.

The operators build the encryptor, the leak site and the affiliate panel, and take a percentage. Affiliates supply the intrusions and keep the rest. The structure is why dismantling a brand rarely removes capability — the affiliates disperse intact.

A contractor who runs intrusions using another group’s tooling for a cut.

The operator side of a ransomware franchise supplies software and infrastructure; the affiliate supplies the break-in. Affiliates move between brands, which is why tradecraft outlives the names attached to it.

Copying data out of an organisation.

The theft itself, as distinct from access. This corpus keeps reachable, taken and published as three separate populations, because a disclosure rarely says which one its number describes.

Demanding payment under threat — of publication, of disruption, or both.

The commercial engine behind most of the incidents here. What is threatened has shifted over time: first losing access to your own files, then publication of what was taken, and increasingly pressure applied to customers and regulators as well.

Scrambling data so it is unreadable without the key.

A protection when you hold the key and an attack when somebody else does. Ransomware inverts the usual purpose: the data is encrypted in place, against the owner, and the key is the thing being sold.

A flaw being exploited before a fix exists.

A vulnerability exploited before the vendor has published a patch, so no amount of prompt patching would have helped. The corpus separates these from known defects with fixes available, because the two imply completely different failures.

The public catalogue number for a specific software vulnerability.

Common Vulnerabilities and Exposures — the identifier that lets everyone refer to the same flaw. A named CVE generates advisories and documentation, which is one reason this database over-covers exploitation relative to stolen credentials.

Software that moves files between organisations, sitting at the network edge.

A product whose job is to receive files from outside and deliver them inward, holding whatever is in transit. Exposed, trusted and full at once — which is why the same group has run the same campaign against four different vendors of it.

Breaking into a supplier to reach its customers.

Compromising a vendor, contractor or software dependency so that the access travels downstream. The affected people usually have no relationship with the company that was breached, and often cannot name it.

The computers that run physical equipment rather than hold records.

Control systems for pumps, furnaces, production lines and grids. Compromise has physical consequences that cannot be restored from backup, and the equipment is frequently too old, too critical or too tightly certified to patch.

Hardware at the network boundary — firewalls, VPN gateways, load balancers.

Equipment that faces the internet by design and is trusted internally by design. It is the most attacked category in this corpus, and it splits into two failure classes: zero-days where the customer could do nothing, and known defects with fixes available.

The channel an intruder uses to steer compromised machines.

Infrastructure that receives check-ins from compromised systems and issues instructions. Blending it into ordinary traffic is most of the craft.

A defect in software that lets somebody do something they should not.

A mistake in design or implementation that an attacker can use. Cataloguing one gives it a CVE number; whether a fix exists at the time it is exploited is the difference between a zero-day and a known defect, and the corpus keeps the two apart.

The vendor fix for a known flaw — and the race to apply it.

A software update closing a specific defect. The gap between publication and installation is where much of this corpus lives, and one of its files records an operation discussing new advisories within days of release, in one case before publication.

An encrypted tunnel into a private network from outside it.

Remote access to an internal network. The gateway that terminates it faces the internet and is trusted inside, which puts it in the most-attacked category in this corpus alongside firewalls and file-transfer appliances.

A fleet of compromised machines controlled together.

Infected devices — often home routers or cameras — marshalled from one point and rented out for scanning, credential stuffing or flooding a target with traffic.

A concrete artefact — an address, a hash, a filename — that shows an intrusion happened.

The forensic residue defenders search their own systems for: attacker IP addresses, domains, file hashes, mailbox rules. It is incident-response output. This corpus is written from public reporting and holds none, which is why the site does not offer them.

The work of containing an intrusion and working out what happened.

Digital forensics and incident response: isolating affected systems, preserving evidence, establishing scope, and restoring service. Its caseload is a different sample from the public record, and biased in the opposite direction.

Stopping an intrusion from spreading further.

The point at which an intruder loses access. It frequently involves deliberately taking services offline, which is why availability harm often begins with the response rather than with the attack.

A separate copy you can restore from.

The traditional answer to ransomware, and only half an answer since double extortion became standard: restoring your files does nothing about the threat to publish them. Attackers also target backup systems first, for exactly this reason.

How long an intruder was inside before anyone noticed.

Conventionally measured from first access to detection. A single figure conflates a long quiet period with a short intense one, so an organisation optimising to reduce mean dwell time may be optimising against the wrong phase.

Reporting on who is attacking, how, and what to look for.

Analysis of adversary behaviour, usually published by vendors who also sell defences against it. Useful and interested at the same time, which is why this desk records who produced a figure alongside the figure.

Naming who did it — an assessment, not a finding of fact.

Assigning an incident to a group or a state. This corpus treats tradecraft resemblance as an assessment and never as an identification; official attribution by a national authority ranks higher but still below a court finding.

The legally required letter telling people their data was taken.

A disclosure obligation owed to affected individuals or a regulator. It is the single largest reason an incident enters the public record — and its absence in jurisdictions without one is the largest reason the record is skewed.

A contractor handling data on behalf of the organisation people actually chose.

In US health privacy law, a company processing protected health information for a covered entity. A person whose records move through one had no opportunity to evaluate it, which is the structural reason these breaches keep topping the annual tables.

A lawsuit brought on behalf of everyone affected.

Litigation aggregating many small harms into one claim. It is one of the routes by which an incident becomes publicly documented — and in at least one file here it moved faster than the notification did.