Hazard

Hazard · updated today

Two questions, answered with evidence.

Which vulnerabilities are attackers actually using — and what it has cost organisations in the UK and the US when the answer was ignored. Every half is built from public data, updated daily, and free to use.

Running Fortinet, Ivanti or Exchange? Build a watchlist and see only what is being exploited in your stack — no account, nothing stored.

1,768 vulnerabilities confirmed exploited
361 used in ransomware campaigns
231 UK enforcement actions on record
£53.58m in UK penalties issued
1,679 US data breaches on record

The evidence, at a glance

The shape of both halves of the record — what attackers are exploiting, what ignoring it has cost, and how the breaches actually happen.

What attackers exploit Vulnerabilities confirmed exploited, by year New additions to the KEV catalogue each year. The solid band is the share later used in ransomware.
02505007501,0002021: 3112021 — of which 8420212022: 5552022 — of which 13220222023: 1872023 — of which 4320232024: 1862024 — of which 4420242025: 2452025 — of which 3120252026: 2842026 — of which 272026
What it costs UK enforcement penalties by year Total ICO fines issued each year — £54m across the record.
£0£6.3m£13m£19m£25m2022: £125k20222023: £14m20232024: £1.9m20242025: £21m20252026: £17m2026
How they happen How US breaches happen Reported cause of the breaches in the Washington State registry.
Cyberattack1,209 72%
Unauthorised access379 23%
Theft or human error91 5%

Newly confirmed exploited

All 1,768 →

Latest UK enforcement

All 231 →

Cause and consequence

Most sites cover one side or the other. The point of putting them together is that the link is real: the failure modes regulators fine organisations for are the same failure modes attackers rely on.

1,679 US breaches · 85 SEC filings What a breach costs in the US The American mirror of the enforcement record: who got breached and how, which public companies told the SEC, and the FTC actions that followed. 361 vulnerabilities · 2 UK cases Ransomware, both ends The vulnerabilities ransomware crews exploit, next to what ransomware has cost UK organisations in enforcement. 3 UK cases Unpatched software The most preventable cause on the register — and the exploited CVEs that are already past their fix deadline. 19 sectors Who pays, and for what Every UK sector the ICO has acted against, ranked by total penalties and dominant failure mode. Sister publication The breaches as they break The Perimeter covers cyber-attacks and data breaches daily — the real-world incidents these exploited vulnerabilities cause.