{
  "name": "The Hacker in a Hoodie Index open data",
  "description": "A read-only, CORS-enabled open-data API over the incident ledger. Static JSON and CSV, regenerated on each site rebuild. No key required.",
  "attribution": "The Hacker in a Hoodie Index (hackerinahoodie.com)",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "docs": "https://hackerinahoodie.com/api.html",
  "generated": "2026-09-03T18:11:23.815Z",
  "cadence": "Static files, regenerated on each site rebuild (typically daily).",
  "terms": "Open data under CC BY 4.0: reuse with attribution to The Hacker in a Hoodie Index. amount_usd is a single incident's own figure and is never a total; figures are never summed across incidents. See /methodology.html.",
  "cors": true,
  "counts": {
    "incidents": 251,
    "government_record": 201,
    "beyond_filings": 69
  },
  "datasets": [
    {
      "name": "incidents",
      "title": "Incident records (JSON)",
      "description": "One row per distinct incident on the public record, with a stable field schema. The primary dataset.",
      "format": "application/json",
      "url": "https://hackerinahoodie.com/incidents.json",
      "records": 251,
      "fields": [
        {
          "name": "organization",
          "description": "The filing or reporting entity named in the record."
        },
        {
          "name": "breached_entity",
          "description": "The party whose data was breached, when distinct from the filer; otherwise null."
        },
        {
          "name": "feed",
          "description": "Which ledger the record belongs to: \"government_record\" (SEC / regulator / state-AG) or \"beyond_filings\" (news, company statements, outside estimates)."
        },
        {
          "name": "disclosed_date",
          "description": "ISO 8601 date the incident was publicly disclosed. Used for ordering; not a display value."
        },
        {
          "name": "date",
          "description": "Human display date of the incident, in \"Mon YYYY\" form."
        },
        {
          "name": "grade",
          "description": "Provenance grade: V (Verified, a primary filing), A (Attested, a named source), or I (Inferred)."
        },
        {
          "name": "amount_display",
          "description": "The incident's own loss figure as shown on the site, or \"Not yet quantified\"."
        },
        {
          "name": "amount_usd",
          "description": "That single figure in USD, or null. It is one incident's own figure and is NEVER a total; figures are never summed across incidents."
        },
        {
          "name": "figure_type",
          "description": "What the amount represents (for example total_incident_cost), or null when no single figure applies."
        },
        {
          "name": "disclosure_case",
          "description": "The disclosure classification for the record."
        },
        {
          "name": "sector",
          "description": "Controlled-vocabulary industry sector, or null when untagged."
        },
        {
          "name": "source_type",
          "description": "Structural source type (for example sec_8k_item_105, state_ag, news)."
        },
        {
          "name": "source_label",
          "description": "Human-readable label for the source."
        },
        {
          "name": "source_url",
          "description": "Link to the primary source for the record."
        },
        {
          "name": "record_url",
          "description": "Path to the incident's own page on the site."
        }
      ]
    },
    {
      "name": "incidents_csv",
      "title": "Incident records (CSV)",
      "description": "The same records, one row per incident, for spreadsheets.",
      "format": "text/csv",
      "url": "https://hackerinahoodie.com/incidents.csv",
      "records": 251
    },
    {
      "name": "incident_figures_csv",
      "title": "Per-figure loss ledger (CSV)",
      "description": "Every published loss figure, one row per figure, with its period, scope, and basis. Never summed.",
      "format": "text/csv",
      "url": "https://hackerinahoodie.com/incident_figures.csv"
    },
    {
      "name": "dataset",
      "title": "Full dataset (JSON)",
      "description": "The complete build payload: the index headline, the annual loss series, sources, both incident feeds, and the market snapshot.",
      "format": "application/json",
      "url": "https://hackerinahoodie.com/data.json"
    },
    {
      "name": "feed_json",
      "title": "New incidents (JSON Feed)",
      "description": "JSON Feed 1.1 of the most recent incidents, for polling.",
      "format": "application/feed+json",
      "url": "https://hackerinahoodie.com/feed.json"
    },
    {
      "name": "feed_rss",
      "title": "New incidents (RSS)",
      "description": "RSS 2.0 of the most recent incidents.",
      "format": "application/rss+xml",
      "url": "https://hackerinahoodie.com/feed.xml"
    }
  ]
}