About the Cyberattack Case Library
A permanent public record of major cyberattacks, nation-state cyber operations, and cybercrime prosecutions, grounded in primary evidentiary sources.
Key Facts
- Independent public repository founded and maintained by Alykhan Jetha ([email protected]).
- Grounds every cyber incident in sworn court dockets, SEC filings, OFAC actions, and CISA advisories.
- Transparent hybrid workflow: deterministic extraction and offline model proposals verified against primary sources.
- 100% static site architecture with zero third-party analytics or ad tracking before explicit visitor consent.
Operator & Editorial Responsibility
The Cyberattack Case Library is an independent open-data research project founded, edited, and maintained by Alykhan Jetha. Queries regarding docket updates, factual corrections, data licensing, or privacy matters can be sent directly to [email protected] or submitted via our Contact page.
The project shares its engineering principles and public-interest transparency standards with sister platform World Power Monitor, which publishes open grid electricity generation and emissions data worldwide.
Editorial Mission & Primary Source Standard
Modern cybersecurity reporting is crowded with vendor marketing claims, anonymous leaks, and fleeting news cycles that disappear without accountability. When an intrusion occurs, early reporting frequently misidentifies the adversary, overstates exploit mechanics, or omits downstream legal consequences.
The Cyberattack Case Library provides an empirical counterweight: a structured public archive compiled from verifiable records. We catalog grand jury indictments, criminal complaints, plea agreements, sentencing memorandums, CISA joint advisories, SEC Form 8-K Item 1.05 material cybersecurity disclosures, FTC consent orders, False Claims Act settlements, and Treasury OFAC sanctions designations. Every technique attribution links directly to a quoted passage and docket or document locator.
Automation & AI Assistance Disclosure
In the interest of full editorial transparency, portions of this archive use structured software automation during ingestion and normalization. Automated scripts poll public government RSS feeds (such as CISA and DOJ releases), normalize statutory citations, and generate standardized ATT&CK Navigator JSON and STIX 2.1 exports. During candidate triage, local offline rules and locally hosted language models may assist in proposing MITRE ATT&CK mappings or drafting structured summaries from long-form court filings.
Every case record, docket number, monetary loss figure, prison sentence, and evidentiary quotation published on the main archive is cross-checked and reviewed by human curation before release. Automated daily digest summaries derived from government advisory feeds are clearly labeled with their issuing agency source link and excluded from primary search indexing when they contain brief feed items.
Static Architecture & Privacy Boundaries
- Isolated Ingestion Pipeline: Data normalization, derivation rules, and schema verification run offline before export into version-controlled JSON datasets.
- Static Pre-Rendering: Every page is rendered into static HTML at build time with zero operational database exposure on the public edge.
- Educational Non-Advisory Scope: Nothing in this repository constitutes legal advice. Read our full Terms of Use & Legal Disclaimer and Evidence Methodology.