You are in more breaches than you know. Only some of them matter.
Nothing in a breach notice tells you whether this one is worse than the last. The Breach Risk Index scores what is actually still circulating, on one scale, so that a stream of notifications becomes an ordered list with something at the top of it.
The Breach Risk Index exists because nobody tells you which breach to worry about. It scores what is actually circulating rather than what was announced, values each exposed field on what it still enables, and places every breach in the corpus on one comparable scale. Where the evidence will not support a number, it says so rather than publishing a low one.
Nobody is ranking them for you at all.
A person is now notified of a breach several times a year and told almost nothing with it. Data "may have been involved." Where a rating appears at all it is high, medium or low, attached to the incident rather than to what the data still enables, and it never changes afterwards. Nothing in that stream tells you which of the forty is the one that matters.
Age with the data, not the incident
A ten-year-old password is worthless. A ten-year-old Social Security number is not, and neither is a diagnosis or the address that links you to your relatives. Retire them together and the oldest breach on the list looks harmless when it is the one that still works against you.
Read the fields, do not count them
Thirty weak demographic columns should not outrank a short, operationally dangerous package simply by being longer. What matters is not how many sensitive fields leaked. It is what they assemble into: an account recovery, a proofing package, an address next to a routine.
Be able to say it does not know
A model that must always produce a number will produce a low one when the evidence is thin, and a low number reads as safety. The Index publishes its confidence alongside the figure, and withholds the figure entirely when the evidence cannot carry it.
What was disclosed, and what is circulating.
A company says Social Security numbers "may have been accessed." The dataset an analyst can actually inspect contains emails and names. Those are not the same state of risk, and almost every breach rating in the market treats them as though they were.
What is observed
The risk supported by the fields actually seen circulating, subject to evidence quality and market availability. This is the number the Index publishes.
What was reported
The credible reported-but-not-yet-observed exposure. It is tracked separately and never folded into the published score. The distance between the two is the scope gap.
of audited records had a live parsed field count that disagreed with the breach count the entity reported. The mismatches were rarely arithmetic. They were different units and different scopes: people counted against parsed rows, disclosure counted against circulation. Source-scope audit, 48 records with live parsed counts
Knowing your email leaked is not information.
Knowing that your email, your date of birth and your former address leaked together, and that the three of them support an account recovery against your bank, is. The Index scores what the assembled data lets someone do, across eight families of attacker capability.
The status is part of the number.
Every published score carries a prefix saying what the evidence behind it will support. A model that cannot say "we do not know" will always say something, and what it says will be a low number that looks like safety.
Judgment that was made once, and holds everywhere.
Every field the corpus contains has been valued, aged and assigned its attacker roles by an analyst, once, and then behaves consistently across every breach it appears in. A field nobody has reviewed cannot quietly receive a generic score: it blocks publication until someone looks at it.
What the Index does not claim.
Methodology is stated with every score on this site. So is the boundary of what a score is entitled to say.
It is not a prediction that a particular person will be attacked. It measures what the circulating data makes possible, not what anyone intends to do with it.
It is not a probability of financial loss. There is no honest conversion from an index value to a dollar figure, and any vendor offering one is selling a number rather than a finding.
Breach size is diagnostic, not hazard. A million parsed rows are not a million people, and the same Social Security number is not more dangerous because it appeared in a larger file.
A reported field is not assumed to be circulating. Disclosure sets the potential scope. Only observation moves the published number.
It does not publish a precise number when the evidence cannot support one. That is what Unscored is for, and it is used.
The score is the start of the question.
Knowing a breach is dangerous is not the same as knowing whether you are in it, or what it joins to on you.
An exposure audit maps every record an adversary can reach on a client, this corpus included, and works the findings at the source. The research behind the scoring sits in the data breach hub, and the entities trading the data are indexed in CODEX.
- Phone
- 855.76.ERASE
- info@obscureiq.com
- Counsel
- Introductions on request
- Handling
- Encrypted intake. Off the record by default.