Categories
Incidents in the Index are classified into 9 primary categories that reflect how the breach or leak happened, or the regulatory or legal action that followed it.
Ransomware and extortion
Attackers encrypt or steal personal data and demand payment, often publishing it on a leak site when the victim refuses.
561 incidents
Hacking and intrusion
Unauthorised access to systems or accounts through exploited vulnerabilities, stolen access or other intrusion.
535 incidents
Malware and credential theft
Infostealers, skimmers and other malicious code that harvest passwords, payment cards or session tokens.
14 incidents
Phishing and social engineering
People are tricked into handing over credentials, data or payments by email, phone, text or impersonation.
21 incidents
Accidental exposure and misconfiguration
Data left open by mistake: unsecured databases and storage buckets, misdirected email, and publishing errors.
153 incidents
Insider misuse and error
Employees or contractors who access, take or disclose personal data without authorisation, deliberately or by mistake.
61 incidents
Third-party and supply chain
A breach at a vendor, processor or software supplier that exposes the data of its customers' customers.
79 incidents
Lost or stolen devices and records
Laptops, phones, drives and paper files that are lost, stolen or disposed of without being secured.
4 incidents
Regulatory action and litigation
Fines, enforcement notices, court cases and settlements that follow a breach or a failure to protect personal data.
120 incidents