Breach Intelligence: events, severity, and alerts

Erin Conry

Breach Intelligence is a feed for third party risk teams to identify, track, and respond to breach-related incidents. It draws on public news sources and the threat underground, and it shows events in date order for the organizations in your portfolio.

This article describes how to use the feed, how the two alert types differ, and what the severity levels and event types mean.

Availability

Breach Intelligence is available in Continuous Monitoring (CM) and in all Security Performance Management (SPM) packages except Core. Email alerts for Breach Intelligence events are available in SPM only.

What is the difference between Threat Intelligence and Public Disclosure alerts?

In SPM, you can receive email alerts for Breach Intelligence events in two ways. The two alert types cover different kinds of events: Threat Intelligence alerts and Public Disclosure alerts.

	Threat Intelligence alert	Public Disclosure alert
Notifies you when	A breach event is reported on your company or its subsidiaries indicating a possible breach	A public disclosure is publicly reported information about a possible breach related to your company.
Source of the event	Bitsight scans thousands of underground forums, dark web marketplaces, ransomware leak sites, Telegram channels, and public sources.	A human-reviewed security incident from publicly reported information about a breach or other security incident, even without confirmed data loss. Bitsight gathers information from government portals such as SEC.gov, news sources and blogs, and FOIA requests.

Public Disclosures capture publicly reported security incidents using sources such as government filings, news, and FOIA requests. Each incident requires a credible public source and human approval.

Threat Intelligence is broader: it covers threats, attacker activity, and signs of potential compromise that can help companies investigate and respond, even before an incident is publicly disclosed.

Why might a breach appear in Threat Intelligence before it appears in Public Disclosures?

Threat Intelligence can surface early signs of a possible breach from ransomware leak sites, underground forums, and Telegram channels before news coverage or a disclosure from the affected company.

Public Disclosures require a credible public source and human review and approval. Dark web claims need additional corroborating evidence, so an event may appear later as a Public Disclosure once those requirements are met.

Breach Intelligence brings both together in one feed, providing early visibility through threat intelligence and additional context as public disclosures become available.

Recommended Steps

Recommended steps are generated based on a combination of event type and severity. Users should use these as a guide as they do not override their organization’s breach-responses processes.

How can I filter the Breach Intelligence feed?

User are able to filter this feed on the following data sets:

Filter	What it filters by
Severity	The severity level of the event. See the severity levels on the tabs below.
Event Type	The type of breach event. See the event types on the tabs below.
Industry	The industry of the affected organization.
Geography	A country or territory.
Company	A named company.
Date	A date range.

Severity Types

Breach Intelligence assigns each event a severity level based on the type of event, the volume of records disclosed, and how sensitive those records are. The feed includes official disclosures and unofficial sources, such as Telegram and ransomware leak sites. Use severity as a guide for when to start your internal breach-response process.

Severity	Meaning
Critical	Evidence suggests a high probability that a breach occurred and that data was exfiltrated, compromised, or encrypted. A threat actor may provide proof of work, such as sample files on a leak site, or a vendor or government body may confirm a large-scale compromise. Large numbers of sensitive records, such as PII or PHI, also place an event at this level. A breach response is recommended.
High	The vendor is being actively targeted by sophisticated actors, such as state-sponsored groups or organized cybercrime, or a critical, exploitable vulnerability in its environment is likely being targeted. A data dump may not be public yet, but the probability of compromise is high. Action on behalf of the vendor or client is warranted.
Medium	The scope is Undisclosed or Unknown, or a security lapse, such as an unsecured database, was found without proof of malicious exfiltration. This level points to a hygiene failure or a near-miss.
Low	An isolated incident with very limited scope, such as one misdirected email, or an internal incident remediated without external compromise. This level usually reflects human error rather than a systemic infrastructure problem.

Event Types

Event type	Meaning
Breach	Dark web exposure of the entity. Internal assets or sensitive records may have been exfiltrated.
Ransomware	An attack that blocks access to a computer system until a ransom is paid. A successful attack means a high probability of network compromise and data exfiltration.
Cyber Crime	A news outlet identified the organization as the victim of a financially motivated attack.
State-Sponsored Operations	A news outlet identified the organization as the victim of a state-sponsored attack.
Hacktivism	The organization was posted as a victim of an ideologically motivated attack, such as a possible breach or denial-of-service attack.
Human Error	An unintentional action that directly compromises a sensitive asset.
Lost / Stolen Asset	An information asset went missing, through misplacement or theft.
Lost / Stolen Asset (Encrypted)	An encrypted asset went missing, with no evidence that the encryption was compromised.
Unsecured Database	A database was left unsecured, so third parties can access the data.
Privilege Abuse	Unapproved or malicious use of organizational resources beyond what is authorized.
Web Apps	A web application was the attack vector, including code-level vulnerabilities and bypassed authentication.
Espionage	Unauthorized access with a state-sponsored or industrial espionage motive, often targeting trade secrets or intellectual property.
Denial of Service (DOS)	An attack intended to disrupt the availability of networks and systems.
Crimeware	Malware installed to acquire unauthorized data or assets.
ATM / Skimmer	A physical attack on an ATM, or use of a skimming device to collect payment card data.
POS (Point-of-sale)	Remote attacks on environments where retail purchases are made.
Intrusion	Unauthorized access that does not involve exfiltration of records or other resources.
Account Takeover (User)	An attacker uses a user’s account credentials to access a service.
Account Takeover (Employee)	An attacker uses an employee’s account credentials to access a service.
Social Engineering	An attack that uses deception to trick people into divulging information or access.
Phishing	A fraudulent email that mimics an authorized employee or legitimate contact.
Fraud	An organization is tricked into releasing information, funds, or resources to an unauthorized party, without necessarily involving a systems intrusion.
Internal Incident	An incident the organization discovered and remediated with no apparent compromise.
DNS Incident	A DNS-related security incident.
DNS Finding	A self-disclosed DNS event.
Public Disclosure	A human-reviewed security incident that Bitsight evaluates in the Bitsight Security Rating. [link: Bitsight Security Rating article]
Incident Type Undisclosed	A security incident whose classification details are unknown.
Other Incident	A security incident that does not fit another category.
Other Disclosure	A disclosure that does not fit another category.

Source Types

Source type	Meaning
Twitter	A Twitter post.
Telegram	A Telegram post.
Ransomware Leak Site	A dark web site, often called a dedicated leak site (DLS), where attackers publish data stolen from victims who refuse to pay a ransom.
Paste Site	A content-hosting service that stores and shares plain text, such as code, logs, or credentials, through a unique URL. Attackers often use paste sites to share leaked data.
Darkweb Forum	A discussion platform on an encrypted network, such as Tor, where cybercriminals trade data and techniques.
Breach Forum	An illicit community that trades stolen data and hacking tools. It can operate on the dark web, the surface web, or Telegram.
FBI	The Federal Bureau of Investigation.
Cyber News Feed	A continuous stream of cybersecurity news about threats, vulnerabilities, and technology updates.
Government Body	A government agency, such as CISA, that discloses cybersecurity news.
Blog	A security vendor blog that publishes breach and ransomware news.

Publish Date or Recent Edits

November 4, 2026: Clarified different between threat intelligence and public disclosure alerts.
April 8, 2026: Expanded severity types description.
February 20, 2026: Published.