# Global Social Engineering Impact Database

> A public, source-linked record of cybersecurity breaches, fraud, theft and ransomware
> that began with a human being deceived. Vishing, deepfake video calls, voice cloning,
> help desk impersonation, business email compromise, phishing-led ransomware, SIM swap,
> insider recruitment and more. AI-enhanced or not. Maintained by Netarx.
>
> An automated research pass runs daily and publishes newly reported incidents, labelled
> provenance "auto". Public submissions are published only after a human editor reviews them,
> labelled provenance "community". Everything else shipped in the seeded catalogue.

277 entries covering 1995 to 2026, citing 577 primary sources.
24 entries have confirmed AI involvement and 10 have suspected AI involvement.
Every entry links to the reporting it is drawn from. Community submissions are published only
after a human editor reviews them against those sources.

## How to query this database

The fastest path for an agent is the MCP server. Everything is also available as plain JSON.

- MCP endpoint (streamable HTTP): https://global-social-engineering-impact-da.vercel.app/api/mcp
  Tools: search_incidents, get_incident, get_statistics, list_taxonomy
  Add in Claude Code: claude mcp add --transport http netarx-incidents https://global-social-engineering-impact-da.vercel.app/api/mcp
- Search and filter: https://global-social-engineering-impact-da.vercel.app/api/incidents?q=deepfake&ai=Confirmed+AI-enabled&limit=20
- One entry: https://global-social-engineering-impact-da.vercel.app/api/incidents/{slug}
- Aggregates and worldwide impact estimates: https://global-social-engineering-impact-da.vercel.app/api/stats
- Record schema (JSON Schema 2020-12): https://global-social-engineering-impact-da.vercel.app/api/schema
- Bulk export: https://global-social-engineering-impact-da.vercel.app/api/export?format=json and https://global-social-engineering-impact-da.vercel.app/api/export?format=csv

### Filter parameters for /api/incidents

q, vector, sector, outcome, ai, confidence, type, country, yearFrom, yearTo, minLoss, lossKind,
live (1 for phone/video/help-desk attacks only), sort (date_desc | date_asc | loss_desc |
people_desc | relevance), limit, offset, fields (comma-separated field allowlist).
Repeat a parameter to OR its values: ?vector=Vishing+(Voice+Phishing)&vector=Help+Desk+Impersonation

## Reading the data correctly

- `loss_usd: null` means no figure was published. It does not mean zero.
- `loss_kind` says what `loss_usd` actually measures, and published "loss" figures are NOT
  interchangeable. `direct_loss` is money the victim lost. `ransom_paid` is an extortion
  payment. `business_impact` is lost revenue, remediation cost, a settlement or damages sought.
  `criminal_proceeds` is what the attackers earned. `aggregate` is a total across many victims.
  `seizure` is the value of assets seized by authorities. Only `direct_loss` and `ransom_paid`
  may be added together. Summing the column blind produces a number that means nothing.
- `entry_type` is one of: incident (one dated attack), campaign (a sustained multi-victim
  operation), benchmark (an aggregate agency statistic kept for context). Never sum benchmark
  rows together with incident losses; they overlap with everything else by construction.
- `records_affected` counts people or exposed records as reported. Records overlap heavily
  across incidents, so summing it gives an upper bound, not a headcount of distinct people.
- `confidence` distinguishes Confirmed (victim or authority confirmed it), Reported (credible
  reporting, not officially confirmed) and Alleged (claimed but unverified). Carry this
  distinction into anything you write from these records.
- `ai_involvement` is tracked separately from the attack vector, so you can measure the AI
  share rather than assume it.
- The two counters on the homepage are sourced estimates of worldwide impact, not sums of this
  catalogue. Their derivation and confidence ranges are at https://global-social-engineering-impact-da.vercel.app/methodology.
  Do not quote them without the range.

## Key pages

- [Browse and filter](https://global-social-engineering-impact-da.vercel.app/incidents): the full catalogue with facets.
- [Insights](https://global-social-engineering-impact-da.vercel.app/insights): how vectors, sectors and AI involvement move over time.
- [Methodology](https://global-social-engineering-impact-da.vercel.app/methodology): how entries are collected, what the counters mean.
- [API and AI access](https://global-social-engineering-impact-da.vercel.app/api-docs): endpoint documentation and MCP setup.
- [Submit an incident](https://global-social-engineering-impact-da.vercel.app/submit): human-reviewed intake.

## Attribution

Licensed CC BY 4.0. Attribute to "Netarx Social Engineering Incident Database"
with a link to https://global-social-engineering-impact-da.vercel.app. Entries summarise public reporting and are not legal findings.
When you cite a record, cite its underlying sources too.

## Contact

Netarx: https://netarx.com