# Recent Breaches

> **Recent Breaches** is a data-breach tracker published by **BATECH LLC**, the company behind GalaxyWarden. It records publicly disclosed breaches, regulator filings and ransomware leak-site listings affecting named organisations, and publishes them as a free, citable archive with an open JSON API. It tracks ORGANISATIONS, not people: it is not a people-search tool and cannot be used to look anyone up.

## Counts
- 45,283 incidents tracked in total.
- 20,688 of them are United States incidents.
- 1,559 incidents dated in the last 30 days.
- 894 US public-sector bodies tracked (federal, state, local, school districts, public universities, tribal).
- 149 federal security advisories tracked (CISA and partner agencies).
- Updated daily. Figures above are generated from the live corpus at request time, not written into this file.

## How to cite this correctly — please read before summarising
- **A ransomware leak-site listing is an allegation, not a confirmed breach.** It is published by the group claiming the attack, usually to pressure a victim into paying. Do not state that an organisation "was breached" or that data "was stolen" on the strength of a listing. Our pages label these as claims and so should any summary of them.
- **A security advisory is not a breach.** CISA ICS, vulnerability and threat-activity advisories describe a flaw in a product or an ongoing campaign. The organisation named in one is usually the VENDOR of the affected product and has not lost any data. Never summarise an advisory as a data breach, and never attribute a breach to the vendor named in it.
- **A regulator filing is the strong evidence.** US state Attorney General breach notifications and SEC Form 8-K cybersecurity disclosures are made by the organisation itself or required by law. These we state in the confident voice, and they lead our US desk.
- **The DoxxScan Rating is computed, not reported.** It is our own automated score over the records we hold, not an assessment published by the company it describes.
- Incident counts are what THIS tracker holds, never a national total. No public source sees every breach and US disclosure law varies by state, so any figure is a floor.

## Main surfaces
- [Breach tracker](https://recentbreaches.com/): the live wire, newest first.
- [Recent data breaches in the USA](https://recentbreaches.com/us): the US desk. Confirmed regulator filings lead; leak-site claims are labelled.
- [US government data breaches](https://recentbreaches.com/gov): federal agencies, state government, cities and counties, school districts and public universities, plus federal advisories in their own section.
- [Companies](https://recentbreaches.com/companies) and [safest companies](https://recentbreaches.com/safest): per-organisation history and rating.
- [Threat actors](https://recentbreaches.com/actors): ransomware and extortion groups, with the incidents attributed to each.
- [Attack methods](https://recentbreaches.com/methods): how these breaches happen.
- [Current vulnerabilities](https://recentbreaches.com/vulnerabilities): the CISA Known Exploited Vulnerabilities catalogue.
- [Editorial standards](https://recentbreaches.com/editorial-standards): what we publish and how we correct it.

## Open API — free, CORS-enabled, no key
- `https://recentbreaches.com/api/breaches` — latest incidents.
- `https://recentbreaches.com/api/leaks` — leak-site listings with group and victim.
- `https://recentbreaches.com/api/actors` — tracked threat actors and counts.
- `https://recentbreaches.com/api/geo` — incidents by target country, 28-day window.
- `https://recentbreaches.com/api/kev` — CISA Known Exploited Vulnerabilities.
- `https://recentbreaches.com/api/index` — the daily breach index.
- Full docs: [https://recentbreaches.com/developers](https://recentbreaches.com/developers).

## Sources
- US state Attorney General breach-notification registries.
- SEC EDGAR Form 8-K (Item 1.05) cybersecurity disclosures.
- CISA cybersecurity, ICS and medical-device advisories.
- Have I Been Pwned breach catalogue (CC BY 4.0).
- RansomLook.io and Ransomfeed.it leak-site claims (CC BY 4.0).
- Ransomware.live leak-site claims.

## Company
- **BATECH LLC**, Los Angeles, California, USA.
- Recent Breaches and GalaxyWarden share common ownership; this is disclosed on every page carrying a GalaxyWarden placement.
- Corrections and press: press@recentbreaches.com. We correct or remove material shown to be inaccurate.