Every file in this database states what it rests on and how well established it is. This page is the rule set behind that, and the numbers on it are counted from the corpus when the site builds — not written down and left to rot.
A grade says how well established a file is. It does not say how bad the incident was — that is the severity field, and the two move independently. A catastrophic breach reported only by the attacker is graded low; a minor outage confirmed in a regulatory filing is graded high.
A primary document, or two independent sources that do not share an origin.
An SEC filing, a court record, a government advisory with technical detail.
Consistent reporting, but the scope is not established.
Several outlets agree an intrusion happened; nobody has confirmed how many people it reached.
A claim, reported and labelled as a claim.
A leak-site listing, or a figure that originates with the attacker.
Published rather than buried, because the concentration is itself a finding. 97 files rest on a single citation — they inherit whatever that source got wrong. 430 carry no jurisdiction, because the reporting never established where the affected organisation actually operates.
A leak-site figure is an advertisement written by the seller. It appears in the body labelled as a claim, never in the record as a number.
That an organisation paid is asserted only where the organisation, a filing or a court record says so. Researcher inference is not enough.
Not after an arrest, not on the basis of an attacker naming someone, and not from a researcher dossier.
No hashes, no domains, no IPs. The desk has no telemetry of its own, and republishing someone else’s indicator list without the means to verify it is laundering, not reporting.
Where the vector was never established, the record says so. That is 29.4% of the corpus, and the gap is the disclosure regime rather than a gap in reporting.
A file is dated to the incident or its disclosure, never to when the desk got round to writing it. Jurisdiction is the affected organisation’s, never the actor’s suspected origin — the incident map plots the same field for the same reason.
When something is wrong, the correction runs at the top of the file rather than the bottom, and the corrections log on the desk carries it too. Nothing is quietly edited. Corrections go to corrections@forensicpost.com.
The full data set is downloadable as CSV, JSON or STIX, so any claim on this page can be checked against the corpus rather than taken on trust.