Cyberattack Case Library
A public, structured record of real cyberattacks built exclusively from primary sources: grand jury indictments, sworn complaints, court dockets, CISA technical advisories, SEC Form 8-K Item 1.05 disclosures, and OFAC sanctions notices.
Key Facts
- 96 major cyberattack prosecutions, state campaigns, and corporate breaches cataloged.
- 84 MITRE ATT&CK techniques substantiated with verbatim primary source excerpts.
- 24 defendants sentenced with average federal prison terms of 142.3 months.
- Zero secondary reporting: built exclusively from sworn court records, CISA alerts, and SEC disclosures.
A Single Power Outage in Ghana Saved the World's Largest Shipping Line
When the NotPetya wiper obliterated all 150 Active Directory domain controllers across A.P. Moller-Maersk's global headquarters in minutes, the entire company was saved by a single offline domain controller in Ghana that survived solely because of a local blackout. Technicians physically flew the hard drive to London in a passenger seat to restore worldwide operations.
Defensive Stack Audit
Test your defensive controls against 96 landmark attacks to uncover fatal perimeter and lateral bypass gaps.
Item 1.05 Disclosures
Analyze public Form 8-K cyber disclosures, filing delay windows, extortion payments, and materiality precedents.
CISO Briefing Generator
Generate empirical executive briefings, risk committee memos, and board presentations from real cyberattack precedents.
Control Crosswalk
Crosswalk real attack vectors to NIST CSF 2.0, ISO 27001, PCI-DSS v4.0, HIPAA, and EU DORA requirements.
Malware & Wipers Directory
Reverse engineering and legal profiles of landmark malware: NotPetya, AcidRain, KillDisk, SUNBURST, and ALPHV.
Class Action Settlements
Track post-breach class action settlements, issuing bank recoveries, and judicial discovery rulings.
Target Sectors
View all →| Target Sector | Case Count |
|---|---|
| Financial Services | 17 cases |
| Retail | 9 cases |
| Healthcare | 8 cases |
| Banking | 7 cases |
| Energy | 6 cases |
| Government | 5 cases |
| Information Technology | 5 cases |
| E-Commerce | 5 cases |
Sentencing Distribution
View outcomes →| Prison Term | Defendants |
|---|---|
| 1-3 Years | 5 defendants |
| 3-5 Years | 0 defendants |
| 5-10 Years | 8 defendants |
| 10-20 Years | 5 defendants |
| 20+ Years | 4 defendants |
| Life Imprisonment | 2 defendants |
Recent Case Filings & Dockets
Chronological record of federal indictments and disclosures
| Case Title | Legal Status | Sector | Jurisdiction | Techniques | Reported Loss |
|---|---|---|---|---|---|
| Salt Typhoon U.S. Telecommunications Wiretap Infrastructure Infiltration CISA-FBI-JSA-2024-10-SALT | investigation | Telecommunications & Critical Infrastructure | Federal Bureau of Investigation & CISA Joint Investigation | 2 | $500.0 million |
| U.S. v. IRGC Actors (CyberAv3ngers Critical Infrastructure Attacks) 2:24-cr-00185 | fugitive | Water and Wastewater Systems, Energy | U.S. District Court for the Western District of Pennsylvania | 2 | $15.0 million |
| CrowdStrike Falcon Sensor Channel File 291 Global Windows Outage SEC-8K-0001535527-24-000028 | investigation | Information Technology & Cybersecurity | U.S. House Committee on Homeland Security / SEC EDGAR | 2 | $5.4 billion |
| AT&T Cloud Telecom Call and Text Metadata Exfiltration SEC-2024-8K-ATT | investigation | Telecommunications | U.S. Securities and Exchange Commission & DOJ National Security Division | 2 | $100.0 million |
| U.S. v. Amin Stigal (GRU Unit 29155 WhisperGate Wiper) 1:24-cr-00268 | fugitive | Government & Critical Infrastructure | U.S. District Court for the District of Maryland | 2 | $50.0 million |
| CDK Global BlackSuit Ransomware Incident 1:24-cv-05231 | alleged | Information Technology, Retail, Automotive | U.S. District Court for the Northern District of Illinois | 3 | $1.0 billion |
| Snowflake Enterprise Credential Stuffing & Customer Cloud Thefts SEC-2024-8K-SNOW | alleged | Cloud Services, Entertainment, Financial Services, Retail | U.S. Securities and Exchange Commission & FBI Cyber Division | 4 | $500.0 million |
| U.S. v. Rui-Siang Siew (Incognito Market Darknet Extortion) 1:24-cr-00305 | charged | Consumer Privacy, Cryptocurrency | U.S. District Court for the Southern District of New York | 1 | $100.0 million |
| Ascension Health Network Black Basta Ransomware Outage HHS-OCR-2024-ASC | investigation | Healthcare & Hospitals | U.S. Department of Health and Human Services OCR Enforcement | 2 | $1.3 billion |
| U.S. v. Khoroshev et al. (LockBit Ransomware Operation) 2:24-cr-00330 | charged | Healthcare, Education, Manufacturing, Government, Financial Services | U.S. District Court for the District of New Jersey | 9 | $500.0 million |
Frequently Substantiated Techniques
Techniques with the largest number of primary source court citations