Height = published incidents · Color = incident type
Data breachSupply chainRansomwareCredentialsVulnerability exploitationOther
Swipe to earlier months ←
Tap a month to read its breakdown.
Hover or focus a month for its breakdown. Select it to inspect the incidents.
* Historical incident discovery is partial for early months. Lower early counts must not be read as market growth.
Unverified reports hidden. Incident list unchanged.
Incident registry
Latest incidents in Professional services
33 visible incident threads · 20 per page · newest disclosures first
ServiceWhat happenedTypeDisclosedSources
Each row is one deduplicated public incident thread. The chart groups those same rows by disclosure month and incident type, so a selected bar and its registry always share one denominator.
View coverage & limits
Clock. Disclosure date drives both chart and registry. Event date remains separate because it may be missing, approximate or published later.
Categories. Raw incident families are mapped into six stable reading groups: data breach, supply chain, ransomware, credentials, vulnerability exploitation and other.
Evidence. 12,799 source records were clustered into 905 accepted incidents; 903 dated sector incident threads are published here. Unverified threat-actor reports are optional chart context and never enter the incident registry.
Enrichment. 632 clusters searched; 533 with accepted facts; 0 eligible clusters uncached. This remains a manual snapshot.
Boundary. Undisclosed events, sources outside collection and publication bias are not represented. Early historical months are partial and must not be read as evidence of market growth. Snapshot 365d-clean-v1+exa-v1+tinyfish-audited-v1; coverage through Aug 30, 2026.
Public data can show what happened elsewhere. It cannot establish whether the same boundaries hold in your product.