Research & Methodology
This page explains how Cyber Law Institute finds, checks, and updates the information in our reporting, guides, and resources. Our Editorial Standards set out the principles we follow. This page describes the process.
Where our information comes from
We start with primary sources: the original document or the official body responsible for it.
- Breach notices. The notice itself, sent by letter or posted by the organization, and, where one exists, the copy filed with a state attorney general. Not every state publishes these filings.
- Government agencies. Guidance and enforcement records from agencies such as the Federal Trade Commission, the Consumer Financial Protection Bureau, and state attorneys general.
- Laws and regulations. The text of the statute or regulation we describe, linked from the article.
- Court records. Complaints, orders, and settlement documents, and the official settlement website when a claims process exists.
- Organization statements. What a company or platform says publicly, attributed to it by name.
Other publications can point us to a story. When we rely on their reporting, we name and link to it, and we confirm key facts with a primary source before treating them as established.
How we verify a data breach notice
Before we report on a breach or add it to the Breach Notice Tracker, we check:
- The organization. That the notice comes from the organization named, through its own website, mailing, or a regulator filing.
- The dates. When the incident happened, if known, and when the notice was issued.
- The information involved. What the notice says was exposed, in its own words.
- What the organization is offering. Such as credit monitoring or a contact line, as stated in the notice.
- The source and date checked. We record the primary source link and the date we last verified it.
If something can’t be confirmed, we say it is unconfirmed or leave it out.
How we describe the status of a case
A data breach is not automatically a lawsuit, and a lawsuit is not automatically a settlement. We describe each matter at the stage official records show.
| Stage | What it means | What we check |
|---|---|---|
| Incident reported | An organization has disclosed a breach or security incident. | The notice or regulator filing |
| Lawsuit filed | Someone has sued. The claims are allegations, not findings. | The court record |
| Proposed settlement | The parties have agreed to settle, subject to court approval. | The court order and settlement documents |
| Claims open | An official process for submitting claims exists, with a deadline. | The official settlement website and court documents |
| Final approval | The court has approved the settlement. Payments follow the settlement’s terms. | The court’s final approval order |
We do not say a claim, payment, or refund is available unless an official source confirms it.
How we research guides
- We base each step on official guidance, laws, or regulations, and link to them.
- We check deadlines, dollar amounts, and other figures against the source when we publish and when we update.
- We say when a rule depends on your state or on the type of account, payment, or platform involved.
- We use clearly labeled hypothetical examples, never invented real cases.
How we maintain resources
Our resources, including the Breach Notice Tracker and the Digital Evidence Checklist, show the source for each entry and the date it was last checked. We update entries when new information is confirmed and remove or mark entries that can no longer be verified.
Keeping information current
We review guides periodically and whenever a law, regulation, or official guidance they rely on changes. When we make a meaningful update, the article shows the updated date. Corrections are handled under our Corrections Policy.
What we don’t do
- We don’t ask readers to send sensitive documents, such as breach letters with personal details, account statements, or ID.
- We don’t present unverified allegations as facts.
- We don’t let advertisers or sponsors shape our research or conclusions. See our Disclosures.
Help us get it right
If you have information about a breach notice, a case, or an error in our coverage, submit a tip or email contact@cyberlawinstitute.com. Please remove account numbers and other personal details before sending anything.
General information, not legal advice. Last updated: October 31, 2026