Data Spaces
How to read the ledger Every row is an incident or a response. Shape tells them apart; colour and the marks below each sigil carry the rest.
Row type
Incident — a square sigil. The connected dots below carry attribution.
Response — a round sigil. The two squares below show its anchors.
Incident types
Data theft
Disruption
Hijacking
Ransomware & extortion
Response types
Official policy
Unofficial policy
Criminal proceedings
Technical disclosure
Operational action
Reading the marks
Attribution dots (incidents) — how firmly an initiator is named; both filled and joined navy when fully attributed.
none one both
Weight squares (responses) — anchors present: left = a linked incident, right = a named actor.
0 1 2
Issuer stack — one chip is a single issuer; a stack of ISO codes marks a joint or coordinated response.
EUsingle DEFRNL+5several states

An independent, interdisciplinary research consortium providing evidence-based analysis of cyber incidents and the political and legal responses to them.

A consortium of

Heidelberg University · Stiftung Wissenschaft und Politik (SWP)

Data spaces

Reference

Project

© 2026 European Repository of Cyber Incidents Evidence-based analysis of cyber incidents & responses
Search