Live Cuts
One reading from this index’s ledger, recomputed on every build. As of October 21, 2026. · ← All Live Cuts
FROM THE LEDGER · WHAT THE RECORD KNOWS
What an attack did reaches the record before how it began
n = 387 classifiedTwo readings side by side, each out of the 387 classified incidents and never summed: for how many the record shows what the attack did, versus how it began. Often this is not the company’s doing — when a company says nothing, an attacker’s leak-site post or the press can put the outcome on the record anyway. How the attackers got in is harder to learn from anyone.
Outcome and entry point are counted independently, each out of the 387 classified incidents; the two are never added together. For each breakdown, see the separate How the breach happened and What the attacks did cuts.
“On the record” means the fact appears in a source this index grades — a filing, a regulator or court record, the press, or an attacker’s own leak-site post — not that the company disclosed it. A count of incidents, never a dollar figure and never summed.
THE FLOOR · Counted from incidents classified to date, not a census of all attacks.