CRITERIA
Severity criteria
Severity is a rough gauge for comparing how serious incidents are. We judge by combining the number of people affected, the sensitivity of the data (credentials, payments, identity verification), and societal impact. It is not an assessment of a company's overall security.
Severity definitions
| Severity | Indicative criteria |
|---|---|
| SSS | Irrecoverable cascades affecting social functions, e.g. credential leaks at a ten-million scale. |
| SS | Large-scale compromise of sensitive data such as payment or identity-verification records affecting millions. |
| S | Compromise of deep personal data or usable credentials. |
| A | Financial and HR records — information that easily translates into monetary damage. |
| B | Incidents centered on names and contact details. |
| C | Limited data such as email addresses and identifiers. |
| D | Minor misdirected disclosures, with deletion confirmed. |
Confirmation status
To avoid conflating "possible leak" with "confirmed leak", we distinguish three levels based on the wording of official disclosures.
- Leak confirmed: external leakage itself has been confirmed
- Partial leak confirmed: leakage confirmed for part of the information
- Possible leak: unauthorized access etc. confirmed, but leakage itself unknown
Information type categories
Information explicitly named in disclosures is recorded under the categories below. A missing icon does not mean nothing leaked.
- Email address
- User / member ID
- Password
- Auth token
- Card & payment data
- Identity verification data
- Phone number
- Home address
- Full name
- Date of birth
- Health & medical data
Notes
- Ratings are based on information at the time of disclosure and may change with follow-ups.
- Affected counts are as disclosed; counting methods vary by incident.
- Severity is this site's own rating, not an official body's.