PRIMARY SOURCE REPOSITORY • ATT&CK v15.1

Cyberattack Case Library

A public, structured record of real cyberattacks built exclusively from primary sources: grand jury indictments, sworn complaints, court dockets, CISA technical advisories, SEC Form 8-K Item 1.05 disclosures, and OFAC sanctions notices.

Cases

Primary dockets

ATT&CK Techs

With case proof

Threat Actors

Attributed groups

Defendants

Named in charges

Statutes

Title 18 offenses

SEC Filings

Item 1.05 reports

Key Facts

59 major cyberattack prosecutions, state campaigns, and corporate breaches cataloged.
64 MITRE ATT&CK techniques substantiated with verbatim primary source excerpts.
24 defendants sentenced with average federal prison terms of 142.3 months.
Zero secondary reporting: built exclusively from sworn court records, CISA alerts, and SEC disclosures.

CYBER FACT OF THE DAY Heists & Extortion

All Facts Archive (23)→

A Jammed Printer Saved $870 Million from North Korean Hackers

When North Korean Lazarus Group operatives issued 35 fraudulent SWIFT wire transfer orders totaling $951 million against the Bangladesh Central Bank, they were stopped from stealing the remaining $870 million because a local automated receipt printer on the 10th floor jammed and ran out of paper, alerting staff to anomalous transactions.

Source: DOJ Indictment 2:18-mj-02222

Share Fact:

Interactive Tool →

Defensive Stack Audit

Test your defensive controls against 59 landmark attacks to uncover fatal perimeter and lateral bypass gaps.

Launch Simulator →

Calendar Explorer →

This Day in Cyber History

Discover what cyberattacks, grand jury indictments, and CISA alerts happened on today's calendar date.

Browse Historical Dates →

Research Insights →

Macro Trends & Analytics

Data-driven metrics across 59 cases: initial intrusion vectors, dwell times, and ransomware payment dynamics.

View Analytics Dashboard →

Target Sectors

View all →

Documented cyber incidents grouped by targeted economic sector.

Top Target Sectors by Case Volume
Target Sector	Case Count
Financial Services	17 cases
Retail	9 cases
Banking	8 cases
Healthcare	7 cases
Energy	6 cases
E-Commerce	6 cases
Telecommunications	5 cases
Education	4 cases

Sentencing Distribution

View outcomes →

Sentence duration distribution across convicted defendants.

Federal Prison Sentence Lengths
Prison Term	Defendants
1-3 Years	5 defendants
3-5 Years	0 defendants
5-10 Years	8 defendants
10-20 Years	5 defendants
20+ Years	4 defendants
Life Imprisonment	2 defendants

Recent Case Filings & Dockets

Chronological record of federal indictments and disclosures

Browse all 59 cases →

Case Title	Legal Status	Sector	Jurisdiction	Techniques	Reported Loss
U.S. v. IRGC Actors (CyberAv3ngers Critical Infrastructure Attacks) 2:24-cr-00185	fugitive	Water and Wastewater Systems, Energy	U.S. District Court for the Western District of Pennsylvania	2	$15.0 million
AT&T Cloud Telecom Call and Text Metadata Exfiltration SEC-2024-8K-ATT	investigation	Telecommunications	U.S. Securities and Exchange Commission & DOJ National Security Division	2	$100.0 million
CDK Global BlackSuit Ransomware Incident 1:24-cv-05231	alleged	Information Technology, Retail, Automotive	U.S. District Court for the Northern District of Illinois	3	$1.0 billion
Snowflake Customer Multi-Tenant Credential Stuffing Campaign SEC CIK 0001640147	alleged	Telecommunications, Entertainment, Banking, Cloud Services	U.S. District Court for the Northern District of California	2	$150.0 million
Snowflake Enterprise Credential Stuffing & Customer Cloud Thefts SEC-2024-8K-SNOW	alleged	Cloud Services, Entertainment, Financial Services, Retail	U.S. Securities and Exchange Commission & FBI Cyber Division	3	$500.0 million
U.S. v. Rui-Siang Siew (Incognito Market Darknet Extortion) 1:24-cr-00305	charged	Consumer Privacy, Cryptocurrency	U.S. District Court for the Southern District of New York	1	$100.0 million
U.S. v. Khoroshev et al. (LockBit Ransomware Operation) 2:24-cr-00330	charged	Healthcare, Education, Manufacturing, Government, Financial Services	U.S. District Court for the District of New Jersey	9	$500.0 million
U.S. v. Daniel Rhyne (Industrial Insider Extortion) 3:24-cr-00122	charged	Industrial Manufacturing, Critical Infrastructure	U.S. District Court for the Western District of Missouri	1	$750,000
ALPHV / BlackCat Ransomware Attack on Change Healthcare SEC CIK 0000731766	alleged	Healthcare and Public Health	U.S. District Court for the District of Minnesota	6	$2.5 billion
Change Healthcare Ransomware Outage (ALPHV / BlackCat) HHS-OCR-2024-001	convicted	Healthcare, Financial Services	U.S. House Energy and Commerce Committee Oversight & HHS OCR	3	$3.0 billion