The independent record of publicly reported cyber attacks.
Compiled, classified and published by one author since 2011 — one consistent taxonomy, no paywall. Built to complement telemetry-based reports, not to replace them.
A chronology of what reaches public view
HACKMAGEDDON is a cyber threat intelligence publication that tracks publicly reported cyber incidents worldwide. Every event is researched manually against open sources, then recorded in a structured, comparable format — so the data can be browsed day by day, aggregated into monthly and quarterly statistics, and compared across years.
Vendor and incident-response datasets show what defenders measure inside their own visibility. HACKMAGEDDON shows what actually reaches public view, as it happens.
What you will find here
Five formats, all built from the same underlying dataset.
Cyber Attacks Timelines
Bi-monthly chronologies with a standardized record for each incident: target, sector, country, technique, motivation and actor where known.
Monthly & Quarterly Statistics
Interactive charts on motivations, attack techniques, initial access, sectors and geography, generated directly from the timelines.
Mega Breaches Tracker
A running record of the largest data disclosures, updated as new incidents are confirmed.
AI Threats Tracker
Documented cases of AI-assisted and AI-targeted malicious activity, from generated malware to abuse of AI agents and models.
Infographics
Ready-to-use visuals for reports, slides and articles, with source and period always indicated.
How every incident is handled
The aim is not to be the fastest, but to be consistent and defensible.
Classification schemes
| Dimension | Scheme |
|---|---|
| Sector | ISIC Rev. 4 (international industrial classification) |
| Technique / initial access | MITRE ATT&CK, with sub-techniques where available |
| Motivation | Four categories, listed below |
| Geography | Target country, split into single countries where possible (otherwise Multiple / Unknown) |
| Dates | Date occurred and date discovered/reported, kept distinct when both are known |
Motivations
Read before you quote a number
- Reporting bias. Incidents in regions, languages and sectors with stronger disclosure rules or press coverage are over-represented.
- Attribution uncertainty. Motivation and actor are recorded as publicly stated or credibly assessed; many remain Unknown, and some are revised later.
- Not a census. The dataset is a large, consistently built sample of public events. It is not an exhaustive count of all attacks, and it is not telemetry.
- Single-author curation. Consistency is a strength, but classification choices are made by one person. The schemes above are published so they can be checked.
For these reasons, HACKMAGEDDON is best used as a trend indicator and a source of concrete, citable cases, ideally read alongside telemetry-based reports.
Using the data in your own work
Charts, timelines and statistics may be cited in articles, reports and presentations with attribution. Please name the publication, the period and the page.
Passeri, P. (2026). HACKMAGEDDON – [Title of timeline or statistics page]. Retrieved from https://www.hackmageddon.com/[page-url]/ Accessed [date].
For commercial reuse, bulk data requests or media use of infographics beyond a quote or a single chart, please get in touch first.
Frequently asked questions
Is HACKMAGEDDON free?
Yes. There is no paywall, and the project is independent and not venture-funded.
Does it count every cyber attack?
No. It records publicly reported incidents with sufficient evidence. Many attacks are never disclosed, so the data should be read as a view of public reporting, not of total activity.
Why are some motivations or actors marked Unknown?
Because there is no credible public evidence yet. Records are updated if reliable attribution emerges later.
Can I suggest or correct an incident?
Yes. Send the source link and what should change, and it will be reviewed against the same criteria as any other entry.
Can I use the charts in my report or talk?
Yes, with attribution (see Cite & reuse above).
Paolo Passeri
Paolo is a cyber threat intelligence professional with more than twenty years of experience in information security. He founded HACKMAGEDDON in 2011 and maintains it personally, from research to classification to publication. He is based in Italy and works at Netskope; HACKMAGEDDON is his personal, independent project.
His work has been referenced by researchers, media and security vendors worldwide.