Understanding Breaches on SecurityScorecard

In this article:

Introduction

The Scorecard Incident page list’s breaches associated with a company, which may impact their score. Breaches can be classified as 1st Party or 3rd Party. For information on how SecurityScorecard collects breach data, please refer to our article on BreachDetails, our proprietary monitoring system that scans news sources, government reports, ransomware sites, and more to populate incident pages.

What is a breach?

A breach occurs when there is a loss of control over data, potentially compromising its confidentiality, integrity, or availability, and affecting the entity that owns the data.

What types of breaches are detected?

• Dark Web Leak: Data stolen from a company is posted on the dark web or leaked publicly.
  Tag: Dark Web Leak
  
  
• Confirmed Breach: The company breached confirms the breach in their own statement(s). This can be done by reporting to numerous U.S. government and state agencies, international agencies, or via >1 reputable news sources.
  Tag: Confirmed Breach
  
  
• Third Party Breach: A breach (i.e. data is lost or leaked) as a result of a relationship with a third party provider, even if the compromised company denies responsibility. 
  Tag: Third Party Breach
  • Rationale: If your car’s brakes fail and cause an accident, your insurance is liable, regardless of who is directly at fault. Similarly, companies bear responsibility for breaches caused by their vendors.
    
    
• Negligence Incident: The loss or theft of sensitive materials (e.g., laptops, notebooks) due to negligence, either internally or externally.
  Tag: Negligence Incident
  
  
• Ransomware Breach: A breach enabled via ransomware. A ransomware event is classified as a breach only if confirmed by a source other than the ransomware group’s extortion site or ransomware aggregators.
  Tag: Ransomware Breach
  
  

What is not a breach?

• Unsubstantiated Reports
  A single news article or claim without corroboration from other reputable sources, government agencies, or the company itself is not considered a breach. If in doubt, please reach out to our support team.
  
  
• DDoS Attacks
  Distributed Denial-of-Service (DDoS) attacks or other cyber events causing downtime without actual data compromise are not breaches.
  • Example: A TechCrunch article on OpenAI’s ChatGPT outage blamed on a DDoS attack shows no evidence of data loss, only service disruption mitigated by standard CDN defenses.
    
    
• Unverified Incidents
  Articles or reports suggesting a breach without widespread agreement or credible evidence are not breaches until further information is found.
  • Example: An article speculating that a 7-Eleven system outage was caused by hackers lacks supporting evidence from other sources.