Severity

This site rates how each organization involved was affected on a four-step scale: Minor, Moderate, Major and Critical (the impact level). An incident's severity is, as a rule, the highest of those levels.

• Critical: personal data of 100,000 people or more, or sensitive data such as My Number, card, bank, health data or passwords, leaked or possibly leaked; core operations or main services down for a day or more; money lost; ransom paid
• Major: personal data leaked or possibly leaked after a confirmed break-in; news reports of data the attackers published
• Moderate: unauthorized access without personal data at risk, defacement, misdelivery or lost devices, important services paused as a precaution for a day or more
• Minor: websites and the like paused as a precaution, outages under a day without effect on data

A Major incident becomes Critical when 1,000,000 records or more leaked, or 50 or more organizations were hit directly or through a supplier. Organizations that only paused as a precaution never raise the severity, however many there are.

Severity applies the criteria to published facts. It does not judge how well an organization responded.

The severity of a vulnerability (CVSS) is a different scale that rates a security flaw in software itself from 0 to 10.0, and is unrelated to severity on this site. [1]

The full criteria are under Severity levels on the About page.

For filtering and sorting by severity, see Severity and impact levels in the guide.