Two public records of the same crime
When a ransomware crew breaches an American company, the event can enter the public record twice. The first record is criminal: the gang posts its victim on a leak site, usually to pressure payment, sometimes to advertise. The second is regulatory: the victim notifies a state attorney general, HHS, or — for a material incident at a public company — the SEC. In the channels that publish such notices (roughly twenty-one states, HHS for breaches affecting 500 or more individuals, and the SEC), that notice becomes a public filing.
The two records are kept by adversaries, for opposite reasons, and almost nobody has measured how often they meet. The closest prior work is a Dutch study that matched leak-site victims against police reports and incident-response records to estimate the true number of ransomware attacks in the Netherlands. Related survey work found that while 92% of entrepreneurs say they would report a ransomware attack to police, about 18% of actual victims did. Both are Dutch; we found no equivalent measurement for the United States' regulatory record — the channel American breach-notification law actually mandates.
This report is that measurement. We took every leak-site claim dated to calendar 2024 — by the attack date listed with the post — whose victim geography resolved to the United States, counting each post once: 2,918 claims. We resolved each claimed victim to an organization, then searched a corpus of 41,878 formal breach filings for any filing by that organization from 180 days before the claim to 540 days after it. Every claim's window had fully elapsed before measurement, so each claimed victim had the same ~18 months to appear in the regulatory record.
The dark share
Of the organizations the criminals claimed as victims, about 11% — 309 of 2,747 as first measured, before the correction — were posted without a usable organization name: the gang published a bare domain, a text fragment, or literally “[Redacted]”. These victims almost never match a filing (as first measured, 2.5% of their claims, and 5 of the 309 organizations, matched anyway), for the obvious reason that there is usually no name to match.
That leaves the identifiable US organizations publicly claimed by ransomware gangs in 2024 — 2,438 of them as first measured. 18.9% of them can be matched to any formal breach filing (as first measured, 465 of the 2,438, or 19.1%). Counting every US-tagged claimed victim, identifiable or not, the share is 17.0% of the 2,729 organizations. Counting claims rather than organizations — a victim can be claimed more than once, by one gang or by several — it is 16.7% of the 2,918 claims. However the ratio is cut, the shape is the same: more than four out of five organizations that ransomware criminals publicly claimed as victims never visibly accounted for it in the regulatory record we can observe.
US-geo-tagged leak-site claims dated to 2024, each post counted once, resolved to organizations and matched against 41,878 formal breach filings. The last two bars (marked *) are as first measured — 2,438 identifiable organizations, 465 of them matched — because the corrections removed 18 organizations and our re-derivation cannot say how they split between those bars; with duplicate copies removed, 18.9% of identifiable organizations matched a filing. Matching and coverage misses push the true matched share above the one we measure; a smaller false-positive class pushes the other way. Corrected September 25, September 30 and October 3, 2026: the published figure counted 3,106 claims and 2,747 organizations; 146 of the claims were duplicate copies of re-dated posts, 30 more were removed on September 28–30 and 12 on October 2, 2026.
Data table — Figure 1
| Stage | Count |
|---|---|
| Claims posted | 2,918 |
| Organizations named | 2,729 |
| Identifiable organizations (as first measured) | 2,438 |
| Matched to a filing (as first measured) | 465 |
Two things this number is not. It is not a lawbreaking rate. Many states' notification duties turn on facts we cannot observe from outside: how many residents were affected, whether personal information was actually acquired, whether an exemption applied. An organization may also have notified individuals directly, or a regulator we do not cover, without ever appearing in our matching — the limitations section reports a spot-check that found exactly such a case. And it is not a claim that the gangs' postings are all true: a leak-site post is a criminal allegation, and some fraction of postings are exaggerated or fabricated. What the number does measure is public accountability: how often a publicly alleged breach is followed by any publicly visible formal disclosure.
An exposure window of close to three months
For the victims who appear in both records, the ordering is stark. Among incident-linked matched pairs — the strictest match tier, where a claim and a filing are linked to the same incident — the criminals published first in more than four of five cases, measured from when the post was first seen on the leak site. Within those, the filing came a median of close to three months later: a quarter took more than five months and one in ten more than eight months. Counting the pairs that ran the other way, the median across all incident-linked pairs is more than two months. (Each figure is a bound that holds on every reading we have. Since our September 25, 2026 correction the pair set these statistics were first measured on cannot be reproduced exactly, and since our September 26 correction every interval runs from the day the post was first seen rather than from the attack date listed with it — see the correction notes.)
356 incident-linked claim-to-filing pairs from the 2024 US cohort, as our re-derivation finds them on the July 31 snapshot with every duplicate copy removed, each measured from when the post was first seen on the leak site. This is not the pair set first published — 308 pairs, measured from the attack date listed with each post — which cannot be rebuilt; the text states each statistic as a bound that holds on this reading and every other we have. The amber column holds the 49 pairs where the filing came first — a different ordering, not a shorter lag. The median marker describes the 307 pairs where the post came first. Restated September 26 and redrawn October 3, 2026 (see the correction notes).
Data table — Figure 2
| Days after the post was first seen | Pairs |
|---|---|
| Filing came first | 49 |
| 0–29 days | 61 |
| 30–59 | 50 |
| 60–89 | 45 |
| 90–119 | 27 |
| 120–149 | 30 |
| 150–179 | 18 |
| 180–209 | 20 |
| 210–239 | 16 |
| 240–269 | 7 |
| 270–299 | 7 |
| 300–329 | 10 |
| 330–359 | 5 |
| 360 or more | 11 |
Those are not abstract intervals. The leak post is the moment the victim's data is publicly advertised as stolen — and, where the gang follows through, circulating and searchable. The regulatory filing is the point at which the breach enters the public record on the victim's side. Between the two lies an exposure window in which the data is advertised to criminal buyers while no public record exists on the victim's side. These lag statistics describe the matched population in aggregate; they imply nothing about the timeliness of any individual filing, because notification clocks start from facts — the organization's own discovery date, law-enforcement delay requests, statutory exemptions — that are not observable from outside.
The pairs that ran the other way are worth a sentence: the organization filed on or before the day the post was first seen on the leak site. Prompt disclosure, in other words, does not prevent criminal publication — but it does close the exposure window, which is the part a victim organization controls.
Visibility tracks who has to file publicly
The sharpest split in the data is sectoral.
Claim-level: n is US-geo-tagged 2024 claims, each post counted once; the rate is the share whose claimed victim matched a filing. Rates marked * — and their bands — are as first measured, on the cohort before duplicate copies of re-dated posts were removed: our re-derivation cannot reproduce them closely enough to correct them (the healthcare row lost 48 of its 417 claims to the corrections, education 31 of 183, manufacturing 12 of 416). Healthcare is the one sector we observe through a national portal: as first measured, 18 of its 136 matches came only through HHS, and without that channel it read 28.3% rather than 32.6% — no other sector lost more than one match. The amber row is a coverage reference, not a sector: claims whose victim carried no sector tag match at 15.4% (as first measured), inside the tagged sectors' range. Whiskers are approximate 95% bands — the healthcare-to-information gap is well outside sampling error, but several adjacent rows are not separable and should not be read as ranked. Sector codes are two-digit family tags. As first measured, about 110 further claims fall in sectors with fewer than 100 claims each.
Data table — Figure 3
| Sector | Claims | Matched |
|---|---|---|
| Health care (62) | 369 | 32.6%* ±4.5* |
| Education (61) | 152 | 28.4%* ±6.5* |
| Finance & insurance (52) | 148 | 23.0% ±6.8 |
| Public administration (92) | 108 | 16.7% ±7.0 |
| Manufacturing (31) | 404 | 15.6%* ±3.5* |
| Transportation (48) | 148 | 15.5% ±5.8 |
| No sector tag | 279* | 15.4%* ±4.2* |
| Professional services (54) | 918 | 13.9% ±2.2 |
| Information (51) | 294 | 9.9% ±3.4 |
The gradient is consistent with who is obliged to file publicly. Healthcare sits under HIPAA's breach-notification rule and a public federal breach portal. Finance carries genuine overlapping duties of its own — the GLBA Safeguards Rule, the banking agencies' incident rules, NYDFS Part 500. Education is a weaker case for a sectoral story: FERPA mandates no breach notification at all. Manufacturing — ranked ransomware's most-attacked sector by several major trackers — has no sector-specific federal breach-notification duty, and its claims match a filing about half as often as healthcare's.
Duty is not the whole story, and the table says so. Professional services — the largest bucket here, and covered by the same general state statutes as everyone else — matches at 13.9%, statistically indistinguishable from manufacturing; public administration sits below both education and finance. So the defensible reading is narrower than “regulation creates visibility”: a sector-specific duty that produces a public filing, as HIPAA's portal does, puts a sector at the top of this table. What orders the rest is not something a cross-section like this one can identify.
Part of the gradient is also ours, not the sectors'. HHS gives us national reach on healthcare breaches — every reported breach affecting 500 or more people, in all fifty states. Every other sector is visible mainly where it filed in one of the 17 state registries we ingest. A manufacturer that lawfully notified in a state we do not observe is counted dark; a hospital in that same state is not.
Half of that asymmetry is measurable. As first measured — before the correction, which we could not re-derive for these two sectors — eighteen of healthcare's 136 matches came only through the HHS portal; drop that channel and healthcare falls from 32.6% to 28.3%. No other sector loses more than one match — manufacturing is unchanged at 15.6% — so the healthcare-to-manufacturing gap narrows from 17.0 points to 12.7, and about three quarters of it survives. The other half cannot be measured at all: a filing made in one of the roughly thirty states we do not ingest is invisible by construction, and that loss falls on every sector except healthcare. Both halves point the same way, so even 28.3% against 15.6% is an upper bound on the true gap rather than a correction of it.
Federal incident-reporting policy is already moving into this space — but with a caveat this data makes concrete: CIRCIA's critical-infrastructure reporting rules, once in force, deliver incident reports to CISA confidentially, exempt by statute from FOIA and state public-records laws alike. They would close the government-visibility gap, not the public-accountability gap measured here. Closing the public gap requires rules that produce a public record, as HIPAA's portal does.
Who posted the claim changes whether the public ever hears
Matched-filing rates also vary nearly two-fold by which gang posted the claim — but the table must be read together with its last column, and with its error bands. It lists the eleven gangs with the most US-tagged 2024 claims, 99 or more each. Approximate 95% bands run ±4 to ±8 points at these n; a two-proportion test puts the BianLian-to-Akira span outside sampling error, but not the mid-table ordering. Adjacent rows should not be read as ranked — which is why this one stays a table rather than becoming a ranked chart. Cells marked * are as first measured, before duplicate copies of re-dated posts were removed: our re-derivation cannot reproduce them closely enough to correct them, so they still include those copies.
| Gang | US claims | Matched | In healthcare |
|---|---|---|---|
| BianLian | 135 | 25.9% | 22.2% |
| INC Ransom | 117 | 24.8% | 26.5% |
| Black Basta | 104 | 24.5%* | 8.7% |
| Medusa | 160* | 24.4%* | 13.1%* |
| BlackSuit | 99 | 23.7%* | 16.2% |
| Hunters International | 118 | 22.0% | 11.9% |
| Qilin | 127 | 17.6%* | 17.3% |
| Play | 330 | 17.0% | 1.5% |
| LockBit 3.0 | 206 | 17.0%* | 13.6% |
| RansomHub | 232 | 16.2%* | 13.8% |
| Akira | 183 | 14.8% | 3.8% |
This is a traceability measure, not a lie detector. Gangs that hunt regulated sectors — BianLian and INC Ransom, with roughly a quarter of their claims against healthcare organizations — leave a paper trail, because their claimed victims are the ones with filing duties. Gangs whose claimed victims skew toward manufacturers and service firms — 1.5% of Play's claims and 3.8% of Akira's are against healthcare — leave far fewer traces. Whether sector mix explains the whole ordering cannot be settled at these sample sizes: the mid-table differences sit inside sampling error and should not be over-read. And a crew that posts more fabricated or recycled victims will land lower on this table for a reason that has nothing to do with its victims' filing behaviour.
What this study cannot show
Every matched-filing rate above is best read as a floor; the report quantifies what it can of the gap above each one and names what it cannot. Claimed victims are matched by resolved organization identity: a name-normalized twin scan bounds the same-name subclass of resolution misses at 0.15% of dark victims, but misses across different name forms — subsidiaries, d/b/a names, filings made by counsel — are undetectable by that scan and remain unquantified. The stricter incident-linked rate — a claim and a filing tied to the same incident — is roughly one claim in ten, as first measured.
The main bias runs the other way, and we quantified its one detectable signature. Because a claim counts as matched when the same organization filed anything in the window, a filing about a different incident can produce a spurious match. As first measured, of the 591 matched claims only 30 had their matching filing attached to an incident that already contains a different leak claim — the signature of a genuinely separate event. Treating all of them as false positives would lower the corrected claim-level rate by at most about one point — from 16.7% to no lower than about 15.7% — since removing the duplicate copies can only shrink that set. A spurious match to an incident no gang ever claimed carries no such signature, so this quantifies the detectable class, not every possible false positive; the method appendix adds a distributional test pointing the same way.
Coverage is the larger limit. We observe 17 states' attorney-general filings, HHS, and the SEC. A victim that notified only a non-covered or non-publishing state, or only affected individuals, is invisible to us and counted dark. In a four-victim manual spot-check of dark victims, three showed no notification evidence anywhere on the public web; one had filed with a state regulator whose archive our corpus does not yet reach. A sample of four bounds nothing — it demonstrates the class exists, not its size.
Every lag is measured from when the post was first seen on the leak site — the day the aggregator we take posts from first recorded it — to the first regulatory filing in the same incident, not from the attack date listed with the post, which often dates the intrusion rather than the post. A post can only be seen once it is up, so measuring from the first sighting leans toward shorter intervals, not longer ones. The cohort itself is still the 2024 claims by that listed date.
The lag statistics carry different biases from the match rates: they are measured only on matched, incident-linked pairs — a regulated-sector-skewed subsample — so selection could move the median in either direction, and the 540-day matching window right-truncates the tail. Every claim received the identical, fully-elapsed window, so there is no differential censoring within the cohort; the operative truncation is the 540-day cap itself, plus residual source-ingestion lag near the window's edge.
The full method appendix — corpus definition, the junk-name predicate, window sensitivity (the claim-level rate moves only between 16.0% and about 17.0% across three matching windows), a capture-recapture estimate of the true US victim population and why we present it only as a research direction — is published with the report. Every figure derives from SQL over the production corpus, and the queries are available on request.
Reproduce this in the product
Every record behind these figures is browsable. The claims feed carries the criminal record and the disclosures feed the regulatory one; an uncorroborated claim shows a corroboration watch — whether a formal filing has yet been linked to it. That feature applies the strict, incident-level test; this study runs the same question backward over a year of history and reports the more generous organization-level answer beside it.
- Claims posted by BianLian — among the most traceable crews in the table
- Claims posted by Akira — among the least traceable
- Healthcare claims versus manufacturing claims
- Incidents — where the two records are joined
- H1 2026 State of Breach Disclosure — the companion market-level report: a record global half the US didn't drive
Sources & prior work
- Meurs, Junger, Cruyff & van der Heijden — Estimating the Number of Ransomware AttacksJournal of Quantitative Criminology, 2025 — the Dutch capture-recapture predecessor
- Matthijsse, van 't Hoff-de Goede & Leukfeldt — To report or not to reportJournal of Criminal Justice 97, 2025 — 92% say they would report; ~18% did
- HHS Office for Civil Rights — Breach Portalthe public federal record for breaches affecting 500+ individuals
- Ransomware.live — leak-site aggregationsource for every leak-site claim in this study; used under its PRO commercial terms
- CISA — CIRCIAincident reports to CISA are confidential by statute (6 U.S.C. §681e)
Corrections: [email protected] — 48-hour SLA. Leak-site claims are sourced from Ransomware.live and used under its commercial terms (source: Ransomware.live). Structured extraction is LLM-assisted with a complete per-field audit trail back to each source document; every figure in this report was human-audited.
Correction · October 3, 2026: the September 30 correction below left 25 duplicated posts held for review. On October 2 all 25 were resolved by removing 26 more duplicate copies, 12 of them inside this report's cohort, so each of those posts now counts once and every figure above that our re-derivation validates has been corrected in place again. The cohort is now 2,918 claims naming 2,729 organizations (was 2,930 and 2,733; first published as 3,106 and 2,747). 18.9% of identifiable organizations and 17.0% of all organizations matched a filing (both unchanged); the counts beside the first rate (465 of 2,438) stay as first measured. The claim-level rate is 16.7% (was 16.9%; first published as 19.0%): in our re-derivation most of those 12 copies matched a filing. By gang, BianLian's claims matched 25.9% of the time (was 27.0%) and Play's 17.0% (was 17.2%), while Akira's stays at 14.8%; BianLian now has 135 claims (was 137), Play 330 (was 332), Qilin 127 (was 128) and RansomHub 232 (was 237), and the healthcare shares moved by half a point or less. Three sector rates moved: finance 23.0% (was 23.5%), transportation 15.5% (was 15.4%) and information 9.9% (was 10.8%), still the lowest; those rows lost 1, 1 and 3 claims, and the healthcare and education rows, whose rates stay as first measured, 2 each. Across three matching windows the claim-level rate now moves between 16.0% and about 17.0% (was 16.2% and about 17.2%), and counting every detectable false positive as wrong would lower it to no less than about 15.7% (was 15.9%). Figure 2 is redrawn. The September 30 correction removed duplicate copies without redrawing it. Restricted to the copies removed on September 25, and with the incident links our same-breach review corrected on September 28–30 set back, the re-derivation behind this redraw reproduces the September 26 figure exactly. On the corrected July 31 snapshot it now finds 356 incident-linked pairs (was 376): 307 where the post was first seen before the filing (was 327) and 49 where the filing came first (unchanged). Three of the corrected links, made on September 28 — each joining a record to the incident of the same breach — add 2 pairs where the filing came first and shorten one interval by 22 days. The median of the pairs where the post came first now falls in the 60–89-day column rather than the 90–119-day one — still close to three months — and every timing bound the text states holds on this reading and on every other we have. Separately, on October 2 we corrected the country recorded for 109 leak claims, mostly US organizations whose state abbreviation had been read as another country's code; on the corrected tags 27 more claims would join this report's 2024 US cohort. This report, Figure 2 included, keeps the geography tags of its July 31 snapshot. On the corrected tags the headline rates rise by about a tenth of a point and every finding holds but one ordering: INC Ransom's claims would match a filing slightly more often than BianLian's (26.1% against 25.7%, well inside sampling error), so the text no longer calls BianLian the most traceable crew in the table.
Correction · September 30, 2026: the September 25 correction below held 136 duplicated posts for review rather than resolving them automatically. Between September 28 and 30, 111 of them were resolved and 112 more duplicate copies removed, 30 of them inside this report's cohort, so every figure above that our re-derivation validates has been corrected in place again. The cohort is now 2,930 claims naming 2,733 organizations (was 2,960 and 2,738; first published as 3,106 and 2,747). 18.9% of identifiable organizations matched a filing (was 19.0%; first published as 19.1%), so 81.1% did not, and 17.0% of all organizations (unchanged); the counts beside the first rate (465 of 2,438) stay as first measured. The claim-level rate is 16.9% (was 17.5%; first published as 19.0%): in our re-derivation most of those 30 copies matched a filing. By gang, BianLian's claims matched 27.0% of the time (was 27.5%), INC Ransom's 24.8% (was 24.6%) and Play's 17.2% (was 18.8%), while Akira's stays at 14.8%, so rates still vary nearly two-fold; the gang counts fell by up to 9, the healthcare shares moved by less than a point, and because BlackSuit now has 99 claims the table lists the eleven gangs with 99 or more rather than every gang with at least 100. The BianLian and Akira rows' approximate bands now overlap slightly, so the gang section now rests the span between them on a two-proportion test, which still puts it outside sampling error. Four sector rates moved: public administration 16.7% (was 16.5%), transportation 15.4% (was 15.3%), professional services 13.9% (was 14.3%) and information 10.8% (was 11.1%); the healthcare, education and manufacturing rows, whose rates stay as first measured, lost 9, 6 and 6 more claims. Across three matching windows the claim-level rate now moves between 16.2% and about 17.2% (was 16.8% and about 17.7%), and counting every detectable false positive as wrong would lower it to no less than about 15.9% (was 16.5%). The timing statistics and Figure 2 were not re-derived for the copies removed on September 28–30: we did not re-run the first-sighting re-derivation behind the September 26 correction, so Figure 2 remains that date's reading and still includes some pairs formed by copies removed since. [Updated October 3, 2026: Figure 2 has since been redrawn with every removed copy excluded — see the correction of that date above.] We did check the text's timing bounds against a reading of today's corpus, which has changed since September 26, with every removed copy excluded, and one no longer holds: there, the 90th percentile falls below nine months, so one in ten is now stated as more than eight months (was more than nine months), a bound that holds on every reading we have. The other timing bounds hold unchanged. 25 duplicated posts remain held for review; at most 13 of the 2,930 claims (under half a percent) may still count twice until they are resolved. [Updated October 3, 2026: all 25 have since been resolved; 12 of the 2,930 claims were second copies and have been removed — see the correction of that date above.]
Correction · September 26, 2026: this report's timing statistics were measured from the wrong date. The aggregator we take leak-site posts from records two dates for each post: the attack date listed with it, and the day the aggregator first saw the post. We measured every claim-to-filing interval from the first, which often dates the intrusion itself rather than the post, so it tended to overstate how long a post had been up before the filing, and it counted as post-first some pairs whose post was first seen only on or after the day of the filing (24 to 29 pairs, depending on the reading). Every interval is now measured from when the post was first seen on the leak site. The pair set cannot be rebuilt (see the September 25 correction), so each statistic is stated as a bound that holds on every reading of it we have — the July 31 snapshot and today's corpus, each with and without the duplicate copies: the criminal post came first in more than four of five pairs (was more than nine of ten; first published as 91%), the filing followed a median of close to three months later (was more than three months; first published as 107 days), a quarter took more than five months (was more than six; first published as more than 200 days), one in ten more than nine months (unchanged; first published as more than eleven) [Updated September 30, 2026: on a reading of today's corpus the 90th percentile falls below nine months, so one in ten is now stated as more than eight months — see the correction of that date above.], and the median across all pairs is more than two months (was about three months; first published as 93 days). Figure 2 now shows the 376 pairs our re-derivation finds on the corrected snapshot, measured the same way; it showed the 308 pairs first published, measured from the attack date. [Updated October 3, 2026: Figure 2 is now redrawn with every removed duplicate copy excluded, and shows 356 pairs — see the correction of that date above.] The ordering finding — the criminal post usually came first — holds on both dates, and no figure outside the timing statistics changes. The cohort is unchanged: it is still the claims whose listed attack date falls in 2024, and the method text now says so rather than calling them claims posted in 2024. A filing made on the day the post was first seen counts as filed first, since the order within that day is unknown. The September 25 correction below and the dated notes keep their wording; the timing figures they quote were measured from the attack date, and this note supersedes them.
Correction · September 25, 2026: this report's cohort counted duplicate copies of the same leak-site post, so several figures were wrong when published, not merely since. The aggregator we take leak-site posts from revises a post's attack date after publishing it, and our ingest identified a post by a hash that included that date, so a re-dated post was counted once per date; 146 of the 3,106 claims were such copies. With them removed the cohort is 2,960 claims naming 2,738 organizations (was 2,747), and every figure our re-derivation could reproduce has been corrected in place — charts and tables included, because the snapshot itself was wrong. The headline holds: 19.0% of identifiable organizations (was 19.1%) and 17.0% of all organizations (was 17.1%) matched a filing. Those two rates are validated; the organization counts behind them are not. The correction removed 9 organizations, and our re-derivation cannot say how they split between identifiable and junk-named organizations, or between matched and unmatched ones, so the counts shown beside the rates (465 of 2,438 identifiable organizations) are as first measured. The claim-level rate falls further, to 17.5% (was 19.0%): in our re-derivation about half of the duplicate copies matched a filing, against about a fifth of the cohort. By gang, BianLian's claims matched 27.5% of the time (was 31.5%) and Akira's 14.8% (was 15.8%), so rates vary nearly two-fold rather than two-fold, and the gang table now lists every gang with at least 100 claims (was 110). Five sector rates moved on the corrected cohort: finance 23.5% (was 24.2%), public administration 16.5% (18.3%), transportation 15.3% (17.3%), professional services 14.3% (15.4%), information 11.1% (11.5%). What we could not correct: our re-derivation does not reproduce the snapshot's incident-linked pair set (308 pairs); the healthcare, education, manufacturing and untagged sector rates; six gangs' rates; or the junk-name figures (309 organizations posted without a usable name, 2.5% of their claims and 5 of the 309 organizations matched) closely enough to restate them. Those are shown as first measured and marked * or labelled so, and the statistics built on the pair set are now stated as bounds that the first measurement and every re-derivation meet: the criminal post came first in more than nine of ten pairs (was 91%), the filing followed a median of more than three months later (was 107 days), a quarter took more than six months (was more than 200 days), one in ten more than nine months (was eleven), and the median across all pairs is about three months (was 93 days). A further 136 duplicated posts are held for review rather than resolved automatically; about 35 of the 2,960 claims (about 1%) may still count twice until they are. [Updated September 30, 2026: 111 of those posts have since been resolved (110 of them by removing their extra copies); 25 remain held, and at most 13 of the 2,930 claims may still count twice — see the correction of that date above.] [Updated October 3, 2026: the last 25 have since been resolved; 12 of the 2,930 claims were second copies and have been removed — see the correction of that date above.] The dated notes below keep their original wording, with bracketed corrections where a statement no longer holds.
Update · August 4, 2026: continued ingestion — chiefly a rebuild of an HHS OCR reporting backlog — has nudged the claim-level and all-organization matched rates a few tenths of a point above the snapshot figures, the direction the floors framing anticipates (the identifiable-organization rate reads roughly unchanged: matched organizations rose, and identity enrichment grew the identifiable denominator in step), and re-measuring the incident-linked lag on the live corpus now returns a median of roughly 100 days rather than 107 (the newly ingested, shorter-lag HHS pairs pull it down). [Corrected September 25, 2026: the 107-day snapshot median is now stated as more than three months, and the ordering share and tail statistics below as bounds — see the correction above.] [Restated September 26, 2026: every interval is now measured from when the post was first seen, so the ordering share is stated as more than four of five, the median as close to three months and the 75th percentile as more than five months — see the correction of that date above.] The ordering finding — the criminal post came first in 91% of pairs — and the tail statistics hold. Figures above remain the July 31 snapshot (as corrected on September 25, September 30 and October 3, 2026).
Update · August 16, 2026: a re-audit after a large re-extraction of Maine's filings (notification-letter text merged into ~1,700 records) re-derived the incident-linked pair set and reproduced it exactly — same 308 pairs, and the both-directions median still reads 93 days to the day. [Corrected September 25, 2026: that pair set, and the live figures below, included pairs formed by duplicate copies of re-dated posts; our re-derivation no longer reproduces the 308, so these figures are not restated — see the correction above.] Within it, filings that have joined those incidents since the snapshot keep shortening the tail: the post-first share now reads 93.5% (was 91%), the post-first median ~101 days, the 75th percentile 204 days (still above 200, narrowly), and the 90th percentile ~303 days — closer to ten months than to the eleven the August 4 note reported. Lag percentiles, unlike counts, carry no floors guarantee: an earlier filing joining an incident legitimately shortens its lag. The ordering finding is unchanged and slightly stronger. Figures above remain the July 31 snapshot (as corrected on September 25, September 30 and October 3, 2026).
Update · August 18, 2026: a large state-AG backfill has since landed — Massachusetts historical filings, a nineteenth state (Nebraska), and document-capture repairs across several others — all of which can only add filings for claims to match. Re-running the published matching rule on the same 2024 cohort, with filings restricted to the snapshot and then unrestricted, isolates the drift at about +1.4 points on both bases: claim-level 20.2% → 21.6%, all-organization 18.1% → 19.5%. (Those absolute levels sit about a point above the published 19.0% and 17.1% because entity merges since the snapshot fuse organizations and create matches; the like-for-like difference between the two runs is the figure to read, not either level.) That is the direction the floors framing anticipates, but it now matters for one sentence: the “more than four out of five” framing is at its boundary rather than comfortably true, and continued state-AG backfilling will break it. Read it as approximately four in five. The cohort itself reproduces exactly (3,106 claims), and no other finding moves. [Corrected September 25, 2026: that cohort included 146 duplicate copies of re-dated posts; the corrected cohort is 2,960 claims, and the published claim-level and all-organization rates are now 17.5% and 17.0%. The copies sat on both sides of this note's comparison, so the drift it measured is essentially unchanged.] [Updated September 30, 2026: 2,930 claims; 16.9% and 17.0% — see the correction of that date above.] [Updated October 3, 2026: 2,918 claims; 16.7% and 17.0% — see the correction of that date above.] Figures above remain the July 31 snapshot (as corrected on September 25, September 30 and October 3, 2026).