API & Open Data
The whole ledger is open data. Every dataset below is a plain, read-only file served straight from the site: no key, no sign-up, no rate limit, cross-origin reads enabled, under a CC BY 4.0 license. Fetch it from a browser, a notebook, or a cron. The files regenerate on each rebuild, so what you read is what the site shows.
Every dollar figure is a single incident’s own number. Figures are never summed across incidents, and amount_usd is blank where no single figure applies. If you aggregate, you are making a claim this index does not. See the methodology.
Endpoints
One row per distinct incident on the public record, with a stable field schema. The primary dataset.
The same records, one row per incident, for spreadsheets.
Every published loss figure, one row per figure, with its period, scope, and basis. Never summed.
The complete build payload: the index headline, the annual loss series, sources, both incident feeds, and the market snapshot.
JSON Feed 1.1 of the most recent incidents, for polling.
RSS 2.0 of the most recent incidents.
The incidents schema
Fields on each record in /incidents.json (and columns in /incidents.csv). Fields are add-only: new fields may appear, but existing ones are not renamed or removed without a version change.
| Field | Description |
|---|---|
| organization | The filing or reporting entity named in the record. |
| breached_entity | The party whose data was breached, when distinct from the filer; otherwise null. |
| feed | Which ledger the record belongs to: "government_record" (SEC / regulator / state-AG) or "beyond_filings" (news, company statements, outside estimates). |
| disclosed_date | ISO 8601 date the incident was publicly disclosed. Used for ordering; not a display value. |
| date | Human display date of the incident, in "Mon YYYY" form. |
| grade | Provenance grade: V (Verified, a primary filing), A (Attested, a named source), or I (Inferred). |
| amount_display | The incident's own loss figure as shown on the site, or "Not yet quantified". |
| amount_usd | That single figure in USD, or null. It is one incident's own figure and is NEVER a total; figures are never summed across incidents. |
| figure_type | What the amount represents (for example total_incident_cost), or null when no single figure applies. |
| disclosure_case | The disclosure classification for the record. |
| sector | Controlled-vocabulary industry sector, or null when untagged. |
| source_type | Structural source type (for example sec_8k_item_105, state_ag, news). |
| source_label | Human-readable label for the source. |
| source_url | Link to the primary source for the record. |
| record_url | Path to the incident's own page on the site. |
Discovery
A machine-readable manifest of every dataset (URLs, formats, record counts, and this schema) lives at /api.json. Point a client at that to discover everything programmatically.
Example
// Fetch every incident (browser, notebook, or cron; CORS is enabled):
const { records } = await (await fetch('https://hackerinahoodie.com/incidents.json')).json();
// Healthcare incidents that carry a dollar figure:
const priced = records.filter(r => r.sector === 'Healthcare and Life Sciences' && r.amount_usd != null);
// Discover every dataset programmatically:
const manifest = await (await fetch('https://hackerinahoodie.com/api.json')).json();