Cyberattack Case Library
A public, structured record of real cyberattacks built exclusively from primary sources: grand jury indictments, sworn complaints, court dockets, CISA technical advisories, SEC Form 8-K Item 1.05 disclosures, and OFAC sanctions notices.
Key Facts
- 90 major cyberattack prosecutions, state campaigns, and corporate breaches cataloged.
- 64 MITRE ATT&CK techniques substantiated with verbatim primary source excerpts.
- 24 defendants sentenced with average federal prison terms of 142.3 months.
- Zero secondary reporting: built exclusively from sworn court records, CISA alerts, and SEC disclosures.
A Cybercrime Syndicate Created a Real Cybersecurity Firm to Hire Unsuspecting Hackers
The Russian cybercrime syndicate FIN7 (Carbanak) established a front cybersecurity company named 'Combi Security' with legitimate commercial offices in Russia and Ukraine. They recruited university graduates, software engineers, and translators who believed they were doing corporate penetration testing, while actually weaponizing malware that stole millions from Chipotle and Arby's.
Defensive Stack Audit
Test your defensive controls against 90 landmark attacks to uncover fatal perimeter and lateral bypass gaps.
Item 1.05 Disclosures
Analyze public Form 8-K cyber disclosures, filing delay windows, extortion payments, and materiality precedents.
CISO Briefing Generator
Generate empirical executive briefings, risk committee memos, and board presentations from real cyberattack precedents.
Control Crosswalk
Crosswalk real attack vectors to NIST CSF 2.0, ISO 27001, PCI-DSS v4.0, HIPAA, and EU DORA requirements.
Malware & Wipers Directory
Reverse engineering and legal profiles of landmark malware: NotPetya, AcidRain, KillDisk, SUNBURST, and ALPHV.
Class Action Settlements
Track post-breach class action settlements, issuing bank recoveries, and judicial discovery rulings.
Target Sectors
View all →| Target Sector | Case Count |
|---|---|
| Financial Services | 19 cases |
| Healthcare | 9 cases |
| Retail | 9 cases |
| Banking | 8 cases |
| Energy | 7 cases |
| E-Commerce | 6 cases |
| Government | 5 cases |
| Information Technology | 5 cases |
Sentencing Distribution
View outcomes →| Prison Term | Defendants |
|---|---|
| 1-3 Years | 5 defendants |
| 3-5 Years | 0 defendants |
| 5-10 Years | 8 defendants |
| 10-20 Years | 5 defendants |
| 20+ Years | 4 defendants |
| Life Imprisonment | 2 defendants |
Recent Case Filings & Dockets
Chronological record of federal indictments and disclosures
| Case Title | Legal Status | Sector | Jurisdiction | Techniques | Reported Loss |
|---|---|---|---|---|---|
| Salt Typhoon U.S. Telecommunications Wiretap Infrastructure Infiltration CISA-FBI-JSA-2024-10-SALT | investigation | Telecommunications & Critical Infrastructure | Federal Bureau of Investigation & CISA Joint Investigation | 2 | $500.0 million |
| U.S. v. IRGC Actors (CyberAv3ngers Critical Infrastructure Attacks) 2:24-cr-00185 | fugitive | Water and Wastewater Systems, Energy | U.S. District Court for the Western District of Pennsylvania | 2 | $15.0 million |
| CrowdStrike Falcon Sensor Channel File 291 Global Windows Outage SEC-8K-0001535527-24-000028 | investigation | Information Technology & Cybersecurity | U.S. House Committee on Homeland Security / SEC EDGAR | 2 | $5.4 billion |
| AT&T Cloud Telecom Call and Text Metadata Exfiltration SEC-2024-8K-ATT | investigation | Telecommunications | U.S. Securities and Exchange Commission & DOJ National Security Division | 2 | $100.0 million |
| CDK Global BlackSuit Ransomware Incident 1:24-cv-05231 | alleged | Information Technology, Retail, Automotive | U.S. District Court for the Northern District of Illinois | 3 | $1.0 billion |
| Snowflake Customer Multi-Tenant Credential Stuffing Campaign SEC CIK 0001640147 | alleged | Telecommunications, Entertainment, Banking, Cloud Services | U.S. District Court for the Northern District of California | 2 | $150.0 million |
| Snowflake Enterprise Credential Stuffing & Customer Cloud Thefts SEC-2024-8K-SNOW | alleged | Cloud Services, Entertainment, Financial Services, Retail | U.S. Securities and Exchange Commission & FBI Cyber Division | 3 | $500.0 million |
| U.S. v. Rui-Siang Siew (Incognito Market Darknet Extortion) 1:24-cr-00305 | charged | Consumer Privacy, Cryptocurrency | U.S. District Court for the Southern District of New York | 1 | $100.0 million |
| Ascension Health Network Black Basta Ransomware Outage HHS-OCR-2024-ASC | investigation | Healthcare & Hospitals | U.S. Department of Health and Human Services OCR Enforcement | 2 | $1.3 billion |
| U.S. v. Khoroshev et al. (LockBit Ransomware Operation) 2:24-cr-00330 | charged | Healthcare, Education, Manufacturing, Government, Financial Services | U.S. District Court for the District of New Jersey | 9 | $500.0 million |
Frequently Substantiated Techniques
Techniques with the largest number of primary source court citations