THE NUMBERS BEHIND THE INCIDENTS

Statistics

Generated in your browser

A breakdown of the recorded incidents — by root cause, by type, by organisation and over time — computed in your browser from the same data that drives the directory and the linkage map.

Incidents recorded: —
Organisations: —
Records affected (where disclosed): —
Coverage: —

By root cause

How the breach happened, from the affected organisation's point of view. Each incident has exactly one root cause.

—incidents

By incident type

The nature of each incident. One incident can carry several type tags, so these add up to more than the incident total.

Organisations with more than one recorded incident

Where the same organisation (or a vendor serving it) appears in more than one recorded incident. A single breach at a shared vendor can place several organisations here.

By year

Incidents by the year they occurred or were disclosed. Recent years reflect faster public reporting, not necessarily more incidents.

How to read the linkage map

The linkage map groups incidents by the role each one plays in a supply-chain breach. These are the terms it uses.

Upstream incident: The incident at the provider whose own compromise reached other organisations — for example a printing vendor or a CRM host that was breached. An arrow points from the upstream incident to each organisation whose records it affected.
Downstream incident: The incident at an organisation whose data was exposed through that provider, rather than through its own systems. It points back to the upstream incident with an affected-by link.
Standalone incident: An incident with no recorded upstream or downstream causal link. It may still connect to other incidents — for instance a separate breach at the same organisation — shown as a dashed link.
Direct incident: An organisation breached through its own systems: the upstream incidents plus the standalone ones. Downstream-only incidents are excluded from this count to avoid double-counting a single supply-chain breach.
Vendor chain: A cluster where one upstream provider connects to several downstream organisations — the pattern the map exists to surface. The Toppan Next Tech and Ascentis clusters are examples.
Same-organisation link: A dashed line joining two separate incidents at the same organisation (such as an earlier and a later breach), which is a relationship but not a causal one.

Root causes

External attack: A threat actor breached the organisation directly — ransomware, credential compromise, exploitation of a vulnerability, web skimming and similar.
Third-party / vendor: The organisation was compromised through a third-party provider or supplier rather than its own systems.
Misconfiguration / exposure: Personal data was left inadvertently exposed — an open database or storage, an access control removed in error — without a clear attacker.
Human error: An operational mistake by a person, such as a mis-addressed bulk email or a misprinted mailing.
Insider misuse: Someone with legitimate access used or disclosed personal data improperly.

Browse the incident index · Open the linkage map