PROTOCOL DOCUMENT

Methodology

How Cyber Pandemic selects, verifies, classifies and maps incidents. Factual accuracy takes priority over dramatic presentation.

What we track

Significant cyber incidents with documented real-world consequences: ransomware with operational impact, critical infrastructure compromises, major data thefts, and major espionage campaigns disclosed by authorities.
Large non-malicious failures (faulty updates, cloud outages, data-center fires) are included only when their impact was significant, and are always labelled NOT AN ATTACK. They never raise the global threat level.
This is a curated record, not a census. Counts describe this dataset, not global attack volumes.

CONFIRMED — the victim, a regulator or a government authority has publicly confirmed the incident.
REPORTED — consistently reported by established outlets or an official advisory, but not fully confirmed by the victim.
SUSPECTED — plausible but thinly sourced. Suspected items stay in the review queue and are not published as Level 4+.
DISPUTED — material facts are contested by credible parties.

Attribution is recorded only as stated by a named authority (e.g. a government, law enforcement) or by the victim, and phrased that way. Claims by criminal groups are recorded as claims.
Attribution is never inferred by this project and is kept separate from incident facts.

Map markers show the location of the affected organization or infrastructure. For multi-country events the primary affected organization is plotted and all affected countries are listed.
Markers never represent attack origin.

Computed by transparent rules over eligible incidents in the trailing 365 days (see Threat Levels on the home page). Level 4 globally requires at least two Level-4 incidents across two countries.
Level 5 (PANDEMIC) is never computed automatically. It requires a named, dated editorial decision against strict criteria: verified incidents across multiple countries, multiple critical-infrastructure sectors affected, evidence of interconnected or coordinated disruption, and significant real-world consequences.
Headline volume and media attention are never inputs.

A scheduled job reads official advisories (CISA, NCSC, CERT-EU, Canadian Cyber Centre, CISA KEV), vendor threat-intelligence blogs and established security publications.
It separates vulnerability disclosures and outages from attacks, de-duplicates by URL, CVE and headline similarity, groups sources, and assigns a preliminary level capped at 3.
Nothing is published automatically. Every candidate requires human review against original sources before it becomes an incident. Automated summaries are never a substitute for reading the source.

Spotted an error? Corrections are applied to the incident record, and the "last updated" timestamp on that record changes.