01 · Overview
How a candidate becomes a published case
The method is a sequence of editorial decisions followed by consistent measurement. Market performance is not examined until the inclusion decision has been recorded.
-
Candidate incident
Start with a reported cyber or digital-trust event involving an in-scope listed company.
-
Qualification decision
Apply all six listing, event, relationship, evidence, materiality and timing rules before the case can enter the catalog.
- ExcludeOne or more qualification rules fail.
- WaitThe case otherwise qualifies, but the 90-day admission delay has not elapsed.
- ContinueAll rules pass and the admission delay has elapsed.
-
Inclusion recorded
Record the inclusion rationale and review date before opening the return profile. This reduces selection based on an interesting outcome.
-
Market clock set
Anchor the first public disclosure, then select the final close before the market could react and the first reaction close.
-
Company and SPY aligned
Use identical endpoint sessions for the company and SPY, then calculate the defined return windows, recovery state and historical $1,000 comparison.
-
Inspectable case published
Publish the dates, metrics, sources and limitations as one reviewable observation. The result describes what followed disclosure; it does not isolate what caused the move.
02 · Unit
One company, one event, one observation
The unit is a company-event observation. A campaign affecting several issuers—such as NotPetya—receives a shared cluster identifier, but each issuer keeps its own baseline, returns and recovery outcome. This avoids treating one campaign as one tradable security while preserving the relationship between cases.
The catalog is curated. It does not claim to contain every qualifying event since 2001, and the absence of a company does not imply that no material incident occurred.
03 · Qualification
All six conditions must be met
- US-listed security. At disclosure, the instrument traded on NYSE, Nasdaq or Cboe. ADRs qualify; OTC instruments do not. Later acquisitions or delistings are allowed only when usable price history exists.
- Digital-trust event. Eligible categories include security or privacy breaches, ransomware, destructive or disruptive cyberattacks, supply-chain compromise, data misuse, and material software or digital-service failures. Physical recalls and general quality incidents are excluded.
- Direct issuer relationship. The issuer is the victim, responsible vendor or operator, or affected parent company—not a company mentioned only indirectly.
- Documented first public disclosure. One primary source or two independent credible secondary sources must anchor the moment the information became public.
- At least one materiality signal. A materiality statement, disruption of critical operations, quantified financial or consumer impact, significant regulatory action, or systemic reach.
- 90-day admission delay. Editorial acceptance occurs no earlier than 90 calendar days after the first public disclosure date in America/New_York.
After the admission delay, the inclusion rationale and review date are recorded before price performance is examined. That ordering reduces selection based on an interesting market outcome.
Item 1.05 of Form 8-K is an important source for recent US issuers, but it is not a universal eligibility requirement. The SEC’s material cybersecurity disclosure requirements took effect in late 2023, long after this catalog’s start date. See the SEC adoption release.
04 · Evidence
Sources are attached to claims, not merely listed
Each case bibliography labels a source as primary or secondary and records whether it supports disclosure, timing, listing, impact or description. Listing evidence includes the checked date and a note specific to the event period. SEC issuer and filing data provide a validation point; historical exchange status is confirmed for the disclosure date rather than inferred from the company’s current venue. The SEC explains programmatic and archival filing access in its EDGAR data guide.
New observations require manual qualification and review. The scheduled market-data refresh cannot discover or publish a new event.
Market data and derived metrics are refreshed periodically through reviewed data-only updates. Incident Impact is not a real-time data service; the current data-through date is displayed on this page and throughout the site.
05 · Media attention
A fixed source panel, not total US coverage
For each accepted company-event observation, the media layer records written articles published during the first 336 elapsed hours after the catalog disclosure anchor. One unique article URL counts once for that observation and publisher family. The fixed panel is CNN, Fox, Bloomberg, The Washington Post, The Wall Street Journal, Reuters and CNBC.
A qualifying recorded headline must explicitly name the selected company and the article must materially concern the incident, response, consequence or immediate follow-up. Video-only pages, transcripts, live blogs, newsletters, podcasts, generic roundups, duplicate URLs and unrelated company stories are excluded. An attributed syndication or archive copy is assigned to the originating publisher family and marked as an archive.
| Stored interval | Elapsed time from disclosure | Cumulative checkpoint |
|---|---|---|
| First 48 hours | 0 to <48 hours | 48 hours |
| 48–72 hours | 48 to <72 hours | 72 hours |
| Days 4–7 | 72 to <168 hours | 7 days |
| Days 8–14 | 168 to <336 hours | 14 days |
Each case reports the 14-day article count, publisher-family reach, cumulative counts at 48 hours, 72 hours and 7 days, and four local headline-framing labels: descriptive, adverse event, mitigation or action, and favorable. The label describes what the recorded headline emphasizes. It does not measure reader sentiment, article-body tone, publisher stance, blame or reputational impact.
The current registry contains 725 article records. After the initial editorial pass, three isolated Codex agents and Claude Opus 4.8 independently coded a shuffled, blinded set that withheld the production and deterministic-audit labels. All four agreed on 613 records; a strict three-of-four majority resolved another 83. The remaining 29 records received documented rubric-based adjudication. Fleiss’ kappa across the four agent coders was 0.859.
This process tests label consistency across model coders, but it is not independent human double-coding. The favorable label requires an explicit upside for the selected company; benefits accruing only to a competitor, short seller or wider industry do not qualify.
Counts are an observed lower bound. Publisher archives vary by outlet and year, pages can disappear, and some original metadata cannot be recovered. A zero means no qualifying page was recovered under these rules—not that the incident received no coverage.
Every case links to its article-level register, including publisher family, publication window, framing label and publisher or archive URL. Research for this registry was checked on Jul 22, 2026.
06 · Time convention
The baseline precedes the market’s first opportunity to react
Every record stores an ISO 8601 disclosedAt value with an offset and a disclosurePrecision value of exact or date. Exact timestamps are converted to America/New_York for session selection.
| Disclosure circumstance | Baseline | Reaction close |
|---|---|---|
| Before or during a trading session | Previous session close | Current session close |
| After 4:00 p.m. ET | Current session close | Next session close |
| Weekend or market holiday | Last available close | Next available close |
| Date known, time unknown | Previous session close | First close on or after the date |
CrowdStrike is the reference fixture: its content update was released at 04:09 UTC on July 19, 2024, so the baseline is July 18 and the first reaction close is July 19. See CrowdStrike’s preliminary post-incident review.
07 · Measurement
Adjusted-close total returns versus SPY
Build-time daily adjusted close comes from Yahoo Finance for the issuer and SPY. Adjusted close is used as a total-return series that accounts for splits and reinvested distributions. Raw prices are not published in the site; only normalized series and derived results are included in the static build.
company total return % = (company end / company baseline − 1) × 100SPY total return % = (SPY end / SPY baseline − 1) × 100market-relative return pp = company total return % − SPY total return %The six primary windows are the first reaction session, +7 calendar days, and +1, +3, +6 and +12 calendar months. Except for the reaction close, the endpoint is the final trading session no later than the target calendar date.
We deliberately say market-relative return, not abnormal return. A formal event study estimates expected return rather than simply subtracting a benchmark. For that distinction, see A. Craig MacKinlay’s “Event Studies in Economics and Finance”.
08 · Recovery
A mechanical price threshold, not a causal conclusion
Recovery analysis begins only if the company’s adjusted close falls below baseline between the first reaction session and the end of +7 calendar days. The result is the first later close at or above baseline, observed for at most 24 months.
no-initial-drop: no close below baseline in the initial interval.recovered: a later close reached or exceeded baseline within 24 months.not-recovered-24m: 24 months elapsed without recovery.ongoing: the 24-month observation period has not finished.censored-delisted: price history ended before the outcome could be observed.
A recovery close does not show that the market forgot the incident, that reputational damage ended, or that the incident caused the earlier drop.
09 · Hypothetical $1,000
The clock starts at purchase
The user chooses entry at +1, +3, +5 or +7 calendar days. Purchase occurs at the first close on or after that target. Holding periods of 1, 3, 6 or 12 months are then measured from the actual purchase session, and exit uses the last close no later than the resulting target date.
The comparison invests $1,000 in the company and $1,000 in SPY on identical sessions. Fractional shares are allowed; taxes, fees and slippage are omitted; adjusted close assumes reinvested distributions. There is no combined “incident portfolio.”
10 · Aggregation
Median first, with an explicit n
For every window, the landing reports the median market-relative return, the percentage of complete observations below zero and the sample size n. The mean appears as context on case pages. A pending observation is published but excluded from every aggregate whose window has not matured.
11 · Limitations
What these numbers cannot establish
- No causality. Timing and co-movement do not isolate an incident’s effect from earnings, company news, sector changes or macroeconomic events.
- SPY is one benchmark. It does not control for sector, size, factor exposure or a company-specific expected-return model.
- Daily resolution. Adjusted close cannot describe intraday reactions or separate information arriving during the same session.
- Disclosure uncertainty. Date-only records use a conservative previous-close rule and are visibly marked lower precision.
- Selection is editorial. Materiality signals standardize review, but judgment remains. The catalog is neither exhaustive nor random.
- Media retrieval is uneven. Historical publisher inventories and surviving pages differ by outlet and year. Article counts are lower bounds and are not comparable to a complete media census.
- Headline framing is narrow. A four-label editorial classification cannot establish audience sentiment, reputational effect or the tone of an entire article.
- Survivorship and history. Delisting, ticker changes and limited vendor history may censor outcomes.
- No investment use. Historical illustrations omit real-world execution, tax and liquidity considerations.
Other projects have studied a broader set of data breaches, including Comparitech’s share-price analysis. Incident Impact does not claim uniqueness or completeness; its scope includes several digital-trust categories and emphasizes record-level traceability.
12 · Change history
Method changes are versioned
Added a versioned 14-day media-attention source registry, deterministic incident summaries, fixed seven-family publisher panel, article-level evidence routes and local headline-framing labels. Price calculations and historical market-relative returns are unchanged.
Established company-event observations; a 90-day admission delay; US-listing scope; disclosure-time session rules; SPY market-relative returns; periodic reviewed refreshes; six windows; 24-month recovery states; and purchase-anchored hypothetical $1,000.
Future changes that alter historical results require a methodology version increment, regenerated snapshot and documented migration note. Ordinary price refreshes retain the methodology version.