'Data sources & licensing'
Every record is built from public sources. This page lists them, how often we check them, and the license terms we follow.
1. Government sources
HHS OCR Breach Portal (current and archive): public information, breaches of 500 or more people only, lag of weeks to months. State attorney general breach lists, including California, Washington, Oregon and Texas: public, typically days of lag; we follow each site’s terms.
2. Leak-site metadata
RansomLook metadata is used under CC BY 4.0 and credited on each record where used. We record only the group name, date and victim name, never data. Other trackers are used for cross-checking only and are not republished.
3. News, filings and advisories
News coverage, SEC 8-K Item 1.05 filings, CISA and FBI advisories, vendor notices and court dockets. Each is linked on the record that relies on it.
4. Entity matching
We match organizations using the NPI Registry and state business registries to join legal and DBA names.
5. Citing DDSBreach
Cite a record as: DDSBreach. (Year). [Organization] data breach ([State]). Retrieved [date], from https://ddsbreach.com/incident/[id]. Each record page has a "Cite this record" button.
6. Dataset license
Charts and individual records may be reused with attribution. Bulk reuse of the compiled dataset requires a written data license from THE DDS COMPANY LLC.