A New Index Is Tracking Every Major Corporate Data Breach, and Deliberately Leaving the Dollar Totals Out

Key points

• Richard Bird, a cybersecurity executive, launched a public index tracking major reported data breaches.
• The tool is built for security professionals, journalists, policymakers, and everyday citizens.
• It records breaches companies are legally required to disclose, called "material" breaches, meaning incidents serious enough to affect investors or customers.
• Financial losses are logged per incident but never totalled across the index.
• The project lands as U.S. Regulators tighten disclosure rules for publicly listed companies.

A new public database is keeping score on corporate data breaches, and it won't add up the money lost.

Richard Bird, a longtime cybersecurity executive, built the index and opened it to anyone. The premise is simple: when a company suffers a cyberattack serious enough to concern its investors or customers, regulators now require that company to say so publicly. Bird's index collects those disclosures in one place.

Why does it refuse to show total losses?

The decision not to publish a running financial total is deliberate. Loss figures attached to breaches are frequently contested and almost always revised. A single large aggregate number risks misleading the public rather than informing them. Bird's index focuses instead on the fact of each breach and who filed it.

That choice sits inside a broader regulatory moment. The U.S. Securities and Exchange Commission, the federal agency overseeing publicly traded companies, adopted final rules in 2023 requiring disclosure of "material" cybersecurity incidents within four business days of a company determining the incident is material. Item 1.05 of Form 8-K is the relevant filing requirement; most companies came under its scope in late 2023.

Parallel obligations apply in Europe. The EU's NIS2 Directive, short for the Network and Information Security Directive version 2, sets mandatory reporting requirements for critical-infrastructure operators across member states, with most national deadlines falling in late 2024.

Bird's index draws on those mandatory disclosures, not voluntary announcements. Companies don't choose whether to appear in it; the law decides. That distinction matters more than it might look. We covered the compliance pressures underneath similar disclosure frameworks in our July story on behavioral AI and identity-abuse regulation, where the gap between vendor claims and regulatory floors proved to be the real story.

For ordinary people, the practical meaning is this: if a company holding your data reports a breach, that report should now end up in a searchable public record. If you receive a breach notification letter, check whether the company has also filed a formal regulatory disclosure. A notification without a corresponding filing is itself a signal worth watching.

SecurityWeek first reported Bird's launch of the index.