How KarmaSignal works
What we collect, how a claim becomes a verdict, and what the scores mean.
What we collect
Ransomware and extortion groups announce victims on their leak sites. We track those announcements through licensed monitoring services, and we collect official breach records: US state and federal regulator filings, securities disclosures, federal court cases, and published breach datasets. We add vulnerability, exploit and group tradecraft data from openly licensed sources.
What we do not do: we hold no accounts on criminal forums, use no fake personas, buy no stolen data, and never download or store stolen files. Every source we use allows commercial use.
Verdicts
- Confirmed: an official record names an organization matching the claimed victim (by normalized name or the victim's web domain), dated from 30 days before to 12 months after the claim.
- Likely: a near match that a person still has to check: a fuzzy name match, a very short name, a non-US victim matched only by name against US records, or one record matched by several claimed victims.
- Unconfirmed: no official record found yet. This does not mean the claim is false. Many breaches fall below notification thresholds or are filed with regulators outside our coverage, and filings lag claims by weeks or months.
Across 761 confirmed claims from the last two years, the median time from claim to the first official filing was 68.5 days.
Verdicts are recomputed every hour from the full history, so a claim can move from unconfirmed to confirmed when a filing appears. Evidence is shown as types and counts, for example "2 state regulator filings and 1 court case".
Credibility score (0 to 100)
No one can verify a claim on the day it is posted. What we can measure is each group's track record: of its claims old enough to have appeared in official records (120 days), what share were later confirmed. We shrink that rate toward the average across all groups so a group with little history is not scored at 0 or 100, then scale it so a group at the average scores 50 and a group three times as reliable scores 75.
Adjustments: plus 5 when two independent monitors reported the claim, minus 10 when another group claimed the same victim within 180 days. Confirmed claims score 100; near matches at least 70. For victims outside the US the score reflects the group's behavior, not a check of that victim, because most official records we collect are US.
Playbooks
For each group we list the vulnerabilities it has been documented exploiting (ranked by current exploit pressure: known exploitation, public exploit code, mass-scan templates and predicted exploitation), how it gets in, the tools it uses once inside, and the controls that would block most of that, each with the evidence that put it on the list.
Corrections
If a verdict is wrong, email corrections@karmasignal.io. We review every request.