How Vendor History works

We collect security incidents from official public sources every day and match them to the vendors we track. We only publish what a source says, and we link to it.

Sources

California Attorney General breach notices. Businesses must notify the California AG when a breach affects more than 500 California residents. Source
Washington Attorney General breach notices. Required when a breach affects 500 or more Washington residents. Includes the cause the business reported. Source
SEC filings. Public companies file a Form 8-K under Item 1.05 when they decide a cybersecurity incident is material. Filings by a parent company are listed under the vendor they own and show the parent's name. Source
CISA Known Exploited Vulnerabilities catalog. The US Cybersecurity and Infrastructure Security Agency's list of security flaws with evidence of active exploitation. A flaw on this list is a reason to update the product. It does not mean the vendor itself was breached. Source

How we match records to vendors

A breach notice counts for a vendor only when the company that filed it exactly matches a name we've checked for that vendor. "Exactly" means after ignoring punctuation and endings like Inc. or LLC. When a notice is filed for a client (for example "FIS / Example Bank"), we count it for the company that filed it. We'd rather miss a record than pin one on the wrong company.

What a breach notice means

A notice says a business reported a breach of personal information. It might involve customers, employees or other people, and it doesn't say how serious the breach was. Open the source to read the details.

What we don't cover

Breaches reported only to other states, other countries or nobody.
Incidents at private companies that don't file with the SEC and didn't trigger a California or Washington notice.
Outages, and claims made by criminal groups.

So an empty page never means a vendor is safe. It means we found nothing in these sources.

Reusing our data

You're free to quote, share and reuse Vendor History's data, including for commercial use, under the Creative Commons Attribution 4.0 license. Credit "Vendor History" and link to the page you used. Each vendor page has a ready-made citation at the bottom. The underlying records come from the public sources we link to.

Corrections

If something here is wrong, email support@vendorhistory.com. We fix confirmed errors within two business days. Corrections policy