Method and coverage

Every day at 05:10 UTC the scan reads the state attorney general notice portals (California, Washington, Delaware, Oregon, Texas, Vermont, Indiana), the HHS Office for Civil Rights breach portal, SEC 8-K filings under Item 1.05 and cybersecurity incidents under Item 8.01 (each filing read to check it describes an incident the company had), the Have I Been Pwned breach list and security news feeds. Every Wednesday at 13:10 UTC a deeper pass re-reads every portal in full, the HHS archive of resolved cases since 2009, the Maine notice archive (2010 to 2020) and UK ICO enforcement, links breach lawsuits from lawsuits.fru.dev, reads the companies.fru.dev registry, probes registry companies for their own security and trust pages, and saves weekly counts.

Notices about the same organization within a few months are merged into one breach, and each notice stays attached as evidence. A breach is confirmed when an official notice, a regulator, an SEC filing or the organization itself confirms it. News leads that no official source confirms yet are shown as Unverified.

People affected is the figure the organization or a regulator reported. When a later notice raises it, the new figure replaces the old one and the history keeps both. Have I Been Pwned counts are accounts found in the leaked data and are labelled as such. State portals count only their own residents, so they appear on the breach page, not as the total.

The major breaches before the official portals existed, and the big waves (MOVEit, Snowflake customers, Salesforce data theft), were researched by hand from the organizations' notices, regulators and reputable reporting, each with its sources.