Sources we collect
Every fact on a breach, settlement or opt-out page comes from one of these sources, and each page names and links the sources it used, with dates. All are official government, court or settlement sources; CourtListener is a free public copy of federal court dockets.
| Source | What we use | How often we check |
|---|---|---|
| California Attorney General: data security breach list | Organization name, breach dates, date reported and a link to the notice letter | Daily |
| Washington State Attorney General: data breach notifications | Organization name, dates, Washington residents affected, information exposed (via data.wa.gov) | Daily |
| Texas Attorney General: data security breach reports | Organization name, Texans affected, information exposed (the list keeps about 12 months) | Daily |
| U.S. Department of Health and Human Services, Office for Civil Rights: breach portal | Health data breaches affecting 500 or more people: covered entity, people affected, breach type | Every 12 hours |
| U.S. Securities and Exchange Commission: EDGAR (Form 8-K, Item 1.05) | Material cybersecurity incidents disclosed by public companies | Every 6 hours |
| Maine Attorney General: data breach notice archive (2012–2020) | Older notices: total affected, Maine residents, information exposed | Weekly |
| CourtListener (Free Law Project): federal court dockets | Class actions about data breaches: court, filing date and docket link only | Daily |
| Official settlement websites run by court-appointed claim administrators | Claim deadlines, claim forms, payout and eligibility wording, copied exactly | Weekly; daily in the last 14 days before a claim deadline |
| California Privacy Protection Agency: data broker registry | Data broker names, opt-out links and registration answers | Weekly; opt-out links checked monthly |
We collect politely: we follow each site's terms and robots.txt rules, wait between requests and identify ourselves with a contact address. We keep a private archive of the original files for our records; it is never published. Notice letters are linked on the official site, not copied.
How filings become one breach page
- Filings from different agencies are grouped by organization and by the dates of the incident.
- We merge filings into one breach only when our matching rules are confident that they describe the same incident. The exact organization name from each filing is kept and shown in the sources.
- Anything uncertain, such as a possible match with different dates or a name that might belong to a private person, goes to a review list. The site owner checks each item before it is published.
How we use AI
Some facts, such as dates and the types of information involved, are written inside notice letters rather than in an agency's list. We use a language model only to extract these facts into fixed fields. It does not write any text on this site.
- For every field, the model must give the exact sentence from the letter that supports it.
- Each answer is checked automatically: the quote must appear word for word in the letter, and dates and numbers must make sense.
- Anything that fails a check is not used and goes to the review list.
Settlements and lawsuits
Settlement deadlines, claim forms and payout or eligibility wording are copied exactly from the official settlement website, with the date we checked it. For lawsuits we only state that a class action was filed in a named court on a date, with a link to the public docket.
What we never publish
- Personal information about any individual, including names that appear in filings or court records.
- Leaked data, or links to leak sites, forums or the dark web, or instructions for finding them.
- Opinions or accusations about any organization, or guesses about the cause of a breach.
- Copies of notice letters (we link to the official copy instead), or letters that expose a person's details.
- Breaches without an official source.
Updates and corrections
Pages are rebuilt when an agency amends a filing or a settlement website changes. If you see an error, please report a correction.