How we check ourselves

Accuracy audit

A random sample of records, read against their sources again, every quarter

Every quarter a random sample of the tracker’s records is read against its sources again, and the result is published here in full, errors included. Latest (2026 Q4): 96 of 97 checked records agreed with their sources; 1 error was found and corrected.

Audit 2026 Q4 (10 November 2026)

100 records sampled from 5,177. 97 could be checked against a source; 3 could not be read.

96 agreed with their sources.
1 differed and were looked at by a person: 1 was an error and corrected, 0 were a limit of the check.
Of the 97 settled records, 99% said what their sources say.

Differences

Error, corrected Daiichi Kosho: Infosecurity Magazine: the count 8000000 is not on the page, 1 of 1 quotes are not on the page. The count is right: the article says 'over eight million' in words, which the check did not read then (it does now). The quote we kept for how the breach happened, 'supply chain breach', is not in the article as it reads now; it has been removed from the record. (Infosecurity Magazine)

3 that could not be read

REC CANOE CREDIT UNION: the page came back empty (Washington Attorney General)
Love and Vibes: answered 403 (frenchbreaches)
PAMCAH-UA Local 675 Health and Welfare Fund: the register no longer lists this notice on the page it publishes (US Department of Health and Human Services)

The 96 that agreed

How the audit works

A random sample. Every quarter, 100 records are drawn from everything on the tracker except attackers’ claims (which have no page). The draw can be repeated by anyone: records are ordered by the SHA-256 hash of the audit’s name and the record’s id, and the first 100 are taken.
Each record is read against its sources again. A notice from an official register is compared with the register’s own row as it stands today: the organisation’s name and the number of people. A news article or a company’s statement is fetched and searched for the organisation’s name, the number we give, and every quote we keep from it. No AI model takes part in the audit.
A person looks at every difference. A record that does not agree is either an error, which is corrected and logged on corrections and changes, or a limit of the check (a source that shortens a name, say), with the reason given below.

What it does not show: whether the source itself is right. The audit checks that a record says what its source says. A source that could not be fetched (a page that is gone, or a register that has dropped an old notice from its list) is counted apart and not as agreeing.

Found a mistake the audit missed? Tell us: corrections are public, on corrections and changes. The data behind every audit is in that week’s dataset release.

From the data breach tracker: official notices, breach databases and the news, every fact with its source. Open data (CC BY 4.0) · How the tracker works · Official registers · Corrections and changes · Accuracy audit · For journalists · Found a mistake? Tell us and we correct it.