Sources

Everything on thrunt.me comes from the feeds below, each with its license and attribution. Last-success and last-check times come from the live pipeline state. A feed that hasn't succeeded in 48 hours is marked stale, and the next brief carries a notice.

Reports

Every post from these publishers is stored in full and indexed. Research and advisories feed the gap map, the hunt packages and the convergence engine as the analyst party. Press stories show up only as supporting evidence on a convergence.

Research (50)

Government advisories (3)

Press (corroboration only) (1)

Breach notices

Breached organizations file these notices with state attorneys general and HHS. Like an 8-K, a notice is the victim's own disclosure, and it covers private companies and hospitals that never file with the SEC. A notice comes weeks after the breach, so the convergence engine pairs one with another party up to 120 days apart. Most portals give the date the notice was submitted rather than posted, so a notice counts from the day thrunt.me first saw it. Notices show up on this site only as evidence on a convergence card; we don't publish a list. A portal marked behind has posted nothing new in 30 days.

Not collected

• abuse.ch (URLhaus, MalwareBazaar, ThreatFox), CIRCL MISP. Dropped 2026-10-28. Hashes, URLs and IPs with nothing on who used them or how.
• Certificate Transparency. Worth a lookup when investigating one organization, too expensive to run for every organization we track.
• Telegram channels, criminal forums. Too much noise for what they would add.
• ransomlook.io, RansomFeed. ransomlook.io times out and RansomFeed serves a bot challenge, so ransomware.live is the only leak-site source.
• Maine, Massachusetts, New Hampshire breach lists. The sites block requests that don't claim to come from a browser, and we don't pretend to be one.
• Maryland, Indiana, Wisconsin, North Dakota, New Jersey breach lists. Maryland's list stops in March 2025, Indiana publishes yearly PDFs, Wisconsin posts write-ups rather than a list, and North Dakota and New Jersey have no public list we could find.
• Australian Cyber Security Centre. cyber.gov.au times out.
• Trellix, Akamai, Silent Push research. Their feeds return 403.
• Symantec, NCC Group, Dragos, Claroty Team82, Kroll, eSentire, Expel, Coveware, WithSecure, Netskope, Hunt.io. No RSS or Atom feed at any URL we tried.

Status and timestamps are as of the last deploy.