For machines

API and AI access

The whole catalogue is readable without an API key: 277 entries, 577 sources, 1995 to 2026. Licensed CC BY 4.0 with attribution. There is no rate limit beyond ordinary abuse protection, and the endpoints are CORS-open so you can call them from a browser.

MCP server

The fastest route for an AI agent. Four tools over the Model Context Protocol, so Claude and other MCP clients can search the database, pull a full record, read aggregate statistics and check the controlled vocabulary, without you writing any glue.

Endpoint

https://global-social-engineering-impact-da.vercel.app/api/mcp

Add to Claude Code

claude mcp add --transport http netarx-incidents https://global-social-engineering-impact-da.vercel.app/api/mcp

Or in an MCP client config

{
  "mcpServers": {
    "netarx-incidents": {
      "type": "http",
      "url": "https://global-social-engineering-impact-da.vercel.app/api/mcp"
    }
  }
}

search_incidents

Search and filter by text, vector, sector, outcome, AI involvement, country, year range, minimum loss, or live-channel only. Returns summaries or full records.

get_incident

The complete record for one slug, including the mechanics narrative and every source URL.

get_statistics

Aggregate counts and breakdowns, plus the worldwide impact estimates with their caveats.

list_taxonomy

Every allowed value for every categorical field, with usage counts. Call this before filtering.

JSON API

GET/api/incidents

Search and filter. Repeat a parameter to OR its values. Returns a meta block with pagination and a results array.

# Every confirmed AI-enabled case since 2024, biggest loss first
curl "https://global-social-engineering-impact-da.vercel.app/api/incidents?ai=Confirmed+AI-enabled&yearFrom=2024&sort=loss_desc"

# Voice and help-desk attacks against financial services
curl "https://global-social-engineering-impact-da.vercel.app/api/incidents?live=1&sector=Financial+Services&limit=100"

# Just the fields you need
curl "https://global-social-engineering-impact-da.vercel.app/api/incidents?q=deepfake&fields=slug,title,date,loss_usd,sources"

q	Free text. All terms must appear somewhere in the record.
vector	Attack vector, primary or secondary. Repeatable.
sector, country, outcome, ai, confidence, type	Categorical filters. Repeatable.
yearFrom, yearTo	Inclusive year bounds.
minLoss	Minimum published figure in USD. Use 1 for "has a figure at all".
lossKind	direct_loss, ransom_paid, business_impact, criminal_proceeds, aggregate, seizure. Repeatable.
live	Set to 1 for phone, video, help desk and callback attacks only.
sort	date_desc (default), date_asc, loss_desc, people_desc, relevance.
limit, offset	Pagination. limit caps at 500.
fields	Comma-separated allowlist of fields to return.

GET/api/incidents/{slug}

One complete record, including every source.

GET/api/stats

Catalogue totals, breakdowns by every categorical field, entries per year, and the worldwide impact estimates with their sources and confidence ranges.

GET/api/schema

JSON Schema (2020-12) for a record, including the meaning of every enum value. Useful for validation and for teaching a model the field semantics.

GET/api/export?format=json | csv

Bulk download of up to 500 records. Accepts the same filter parameters, so you can export a slice rather than everything.

curl -L "https://global-social-engineering-impact-da.vercel.app/api/export?format=csv&ai=Confirmed+AI-enabled" -o ai-cases.csv

GET/llms.txt

A plain-text manifest telling an agent what this database is, how to query it, and the four ways the data is easy to misread.

Reading the data correctly

A null loss means no figure was published. It does not mean the incident was free. Only 54 of 277 entries carry a comparable victim-loss figure.
Read loss_kind before you sum loss_usd. The column mixes money victims lost, ransoms paid, lost revenue, criminal earnings, multi-victim agency totals and asset seizures. Only direct_loss and ransom_paid measure the same thing. Filter with ?lossKind=direct_loss&lossKind=ransom_paid.
Never sum benchmark rows with incidents. Entries with entry_type: "benchmark" are aggregate agency statistics kept for context. They overlap with everything else by construction.
records_affected overlaps across entries. It counts people or exposed records as reported. The same person appears in many breaches. Summing it gives an upper bound, not a headcount.
Carry the confidence rating through. Confirmed, Reported and Alleged mean different things, and an entry marked Alleged should not be written up as established fact.
The homepage counters are not catalogue sums. They are sourced estimates of worldwide impact with wide confidence ranges. If you quote them, quote the range with them.

Structured data on every page

Each incident page carries schema.org JSON-LD describing the record as an Article about an Event, part of a named Dataset, with every source as a citation and the categorical fields as PropertyValue entries. Crawlers and models that read structured data get the full record without parsing the page.

Sitemap: /sitemap.xml · Manifest: /llms.txt · Schema: /api/schema