How the DoxxScan™ Rating Is Calculated
GalaxyWardenThe DoxxScan™ Rating is a single number from 0 to 100 that estimates how exposed a company’s customers may be if the incidents on its public record are accurate. A lower rating means a higher likelihood that personal information tied to the company is already circulating and could be used to dox or target people. Most incidents in this tracker are unverified listings published by ransomware and extortion groups — accusations, not established facts — and the rating weights them accordingly. It is not a finding that any company was breached.
What goes into it
Every company starts at a perfect 100. A company with no incident on record stays there. A company with one or more takes a flat 20-point deduction for appearing on the record at all — scaled down when nothing on that record is corroborated, so a company known only from leak-site claims takes 9 rather than 20 — and then a further deduction per incident based on five objective factors:
- Number of incidents — more reported incidents means more deductions.
- Severity — a critical breach removes more points than a low-severity one.
- Recency — recent breaches (within the last year) count in full; older breaches count for less, because exposed data ages and defenses change.
- Data sensitivity — breaches that exposed high-risk data such as Social Security numbers, financial details, passwords or medical records carry extra weight, since that data is the most useful for doxxing and identity theft.
- Who established the incident — an incident the organisation itself, a regulator or a verified breach index disclosed counts in full. An incident carried by public reporting but not officially confirmed counts for 80%. An unverified listing posted by a ransomware or extortion group — which is what most entries in this tracker are — counts for 45%, because a leak-site posting is an accusation, not an established fact.
The deductions are summed and the result is clamped to a floor of 5, so no company is ever shown as a flat zero on incomplete data. The calculation is fully automated and deterministic — the same public facts always produce the same rating.
Two rules that are not deductions
Both change the number materially, so they belong here rather than in the code alone:
- A ceiling of 74 for any company with a corroborated breach. The top band below is reachable only by a company with none on record. A single old, low-severity incident will still show as Moderate rather than Low — the rating describes whether data is likely circulating, and one confirmed exposure means it may be. This cap does not apply to a company whose entire record is unverified leak-site claims, for the same reason: nothing has been established, so there is no confirmed exposure to cap for. Those companies cap at 88 instead, and the flat 20-point deduction above is scaled to 9 for them.
- Only incidents involving data loss are counted. A denial-of-service outage, a destructive attack with nothing exfiltrated, or a vulnerability advisory is a real incident and is listed on the company’s page — but it says nothing about whether customer data is circulating, so it does not move this rating.
We also collapse duplicate coverage: one real event reported by several sources within a couple of weeks is scored once, not once per source.
What the bands mean
What it is not
The DoxxScan™ Rating is not a security audit, a certification, or a judgment of a company’s current security controls. It reflects public breach history only, which may be incomplete or later corrected. A high rating does not guarantee safety, and a low rating does not mean a company is currently insecure — only that its past breaches make customer data more likely to be circulating. It is provided for general awareness and is not legal, financial, or security advice.
The DoxxScan™ Rating is an automated, informational estimate of how exposed a company’s customers may be if the incidents on its public record are accurate, derived solely from that record — the number of incidents, how recent and severe they were, the sensitivity of the data involved, and who established the incident. Most incidents we track are unverified listings published by ransomware and extortion groups; those are accusations, not established facts, and they count for less. A lower rating indicates a higher likelihood that personal information tied to this company is circulating and could be used to dox or target individuals. It is not an audit, certification, or assessment of the company’s current security controls, and it does not represent present-day risk. It may rely on incomplete or unverified public reports and can change as new information emerges. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company named here. Provided for general awareness only — not legal, financial, or security advice. How the rating is calculated →