ATTACKS
Attack classification
The registry of known cyber attacks, classified by category, cause and actor, with sources. For the main cases, what a cyber policy would have covered and the underwriting reading.
Attack registry
Every attack classified so far, with sources. Search by victim or group, or filter.
0 attacks
No case matches these filters.
Analysis cases
The most important cases, with what a cyber policy would have paid and the questions for renewals.
0 cases
No case matches these filters.
How to read a case
- Each attack has one category, chosen by its main loss. Causes, actor and loss scenarios are tags that can be combined.
- The attribution level separates what an authority or the victim has confirmed, what a group has claimed and what researchers or journalists only suspect.
- The policy block describes how a standard market cyber policy would respond, not the victim's contract. When the actual cover is public, it is shown separately with its source.
- Every fact comes from an open source. What is not known is written as not known.
Which attacks enter the registry
- An attack enters if the victim or an authority confirmed it, or if at least two reliable sources reported it.
- It must have at least one material effect: an operational outage, data of at least 100,000 people, a declared cost of at least 1 million, a public or critical victim, or a mandatory disclosure such as an SEC filing.
- Claims published by ransomware groups alone are not enough.