Methodology

Evidence levels

Confirmed

Stated by the organization itself, a regulator, a court or an official agency.

Corroborated

Reported by two or more independent credible sources.

Reported

One credible secondary source. Not published on this site.

Claimed

Only the attacker or an interested party says so. Not published on this site.

Incident stages

Suspected security incident

A disruption is confirmed but its cause is not, or the evidence is incomplete.

Confirmed compromise

Unauthorized access is confirmed.

Confirmed operational disruption

Confirmed access, and operations were disrupted or degraded.

Confirmed financial consequence

A loss, refund or payment is stated with a figure.

Attack, discovery, disclosure, containment and restoration are separate dates. A finding about a lender compares the lender's last valuation with the date the incident became public, never with the date it began, so no one is said to have missed what was not yet known.

Relationships

Holds the company's debt

From the lender's SEC schedule of investments. A financial exposure, never an impact.

Current owner

The owner's own portfolio page lists the company as a current investment.

Listed investor

An investor's portfolio page lists the company; current status is not stated.

Customer of the provider

A verified commercial or operational dependency. Impact is not confirmed unless the incident record says so.

A company is matched to a DFX record only when its legal name in the disclosure equals the record's name and its business is consistent; a name alone never merges two records. Lender fair values are summed only across holders of the same borrower's debt, and they are a lower bound, because banks, CLOs and private funds that file no schedule are not included.

Changed conditions

Each finding keeps four judgments apart: the incident's severity, how the company is exposed, what the lenders' own marks said before the incident, and the resulting category (immediate review, material diligence question, monitor, context only, insufficient evidence). They are never multiplied into a probability of default or loss. A credit already impaired before an incident is marked context only, so the incident is not blamed for a decline it did not cause.

What we do not do

• No scanning, probing or access to any system. Public, licensed and filed sources only.
• No credentials, network details, software versions or IP addresses are published.
• No organization is named as compromised on a single report, an attacker's claim or an ambiguous signal.
• No predictive claim about credit outcomes until it has been tested on held-out history.