Methodology: How We Select, Read and Attribute Leaks

How we pick the cases in Ransomware Weekly and Breaches Weekly, how we read the records and how we word what we know.

Last updated

Selection by indexing date

Each edition covers leaks indexed in HaveIBeenRansom between Sunday 00:00 and Saturday 23:59 UTC. A listing can be older than the week it appears in: what counts is when its data became searchable.

  • Ransomware Weekly: victims listed on extortion groups' leak sites.
  • Breaches Weekly: databases posted, sold or shared by data traders on forums and Telegram, first posted in the current year.

Claims vs facts

Groups and channels list, claim or post. We only say an organisation was breached when the organisation itself or a reliable outlet has confirmed it. Inferences are marked as hypotheses.

Attribution confidence

Attribution confidence is a heuristic estimate (method v2.0), not a formal attribution.

Research

The indexing methodology is peer-reviewed in MDPI Electronics.

Corrections

If you represent an organisation we cover, or spot an error, contact us and we will add your version to the post.