noevika

About Noevika

Noevika is a free, public timeline of cybersecurity incidents — data breaches, ransomware claims, actively exploited vulnerabilities and government advisories — collected from the sources below, deduplicated, and delivered on this site and by optional daily or weekly email digest.

Every item links to the publisher that reported it. We do not host leaked data, and we never reproduce content from ransomware leak sites. Information from early reports is often revised; always confirm with the original source.

How it works

Public sources flow into Noevika, which collects, normalises, deduplicates, links and enriches them, and delivers the result as pages, email, chat posts, feeds and a widget.Public sourcesGovernment advisoriesRegulatory breach registriesSecurity newsLeak-site claim trackerVulnerability scoringevery 30 minNoevikaCollectNormalise to one recordDeduplicate & linkClassify entity & sectorEnrich CVEsStore the timelinecontinuouslyWhat you getIncident, organisation,actor & trends pagesEmail digest & instant alertsSlack / Teams postsAtom feeds, JSON, widgetEvery item keeps its link to the original publisher.

Noevika is built around a simple observation: the same incident is usually reported several times, by different kinds of sources, weeks apart. A breach surfaces first as a news story, later as a filing with the US Department of Health and Human Services, later still as a notice to a state attorney general — each under a slightly different organisation name, each with details the others lack. Noevika treats those as one incident with one timeline, and keeps the links to every original report.

Collection
Every 30 minutes an ingestion job queries the ten sources below. Each has its own adapter — RSS and JSON where offered, a table parser for registries that publish tables — and each is tested against stored copies of the source's real output, so a site redesign fails loudly rather than silently returning nothing.
Normalisation
Each report becomes one record: a stable identifier, the original URL, the source, the date the source reported it, the date Noevika stored it, a type (breach, ransomware, vulnerability, advisory, news), a severity, a sector, and where available the organisation, the threat actor and any CVE identifiers. Severity for regulatory filings follows the number of individuals affected; sector is classified across eighteen sectors.
Deduplication
Reports of the same event are matched across sources and across time — breach filings can lag the first news story by weeks — and collapse into one incident. The later reports are not discarded: they attach to the incident as “also reported by” links with their own dates, which is what makes the timeline possible.
Entities
Organisation and threat-actor names are normalised so that variations in legal form and punctuation resolve to one page. Each organisation or actor page is a query over the record, not a hand-maintained list, so it is complete and current by construction.
Enrichment
For every incident that names a CVE, Noevika attaches the FIRST.org EPSS score — an estimated probability that the vulnerability will be exploited within thirty days — and, for entries in the CISA catalogue, the federal remediation due date, whether it is known to be used in ransomware campaigns, the affected product, the required action and the vendor's own advisory.
Delivery
The record is available as web pages, a daily or weekly email digest filtered by sector, instant alerts for a personal watchlist of organisations and keywords, posts to a Slack or Microsoft Teams channel, Atom feeds for the whole record or any sector, organisation or actor, an open JSON interface, and an embeddable widget for other websites. The weekly trends page summarises the last seven days.
Privacy and security
Sign-in uses an emailed one-time code; there are no passwords. Names and email addresses are encrypted at rest and accounts are looked up by a keyed hash, so the database holds no plaintext email. Consent to the Terms and to email is recorded separately with its version and time; every email carries one-click unsubscribe headers; a bounced or complained-about address is switched off automatically; accounts that never verify are deleted after seven days. The service runs on serverless infrastructure with no idle servers.

Sources

Feeds & API

The deduplicated timeline is available as Atom feeds you can subscribe to in any reader or Slack: all incidents, or filtered — e.g. /feed.xml?sector=healthcare, /feed.xml?type=ransomware. Every organisation and threat-actor page has its own feed link. The same data is available as JSON at https://api.noevika.com/incidents; please keep the source attribution on every item. Want the list on your own site? Use the embeddable widget.

Questions

Where does the information come from?
Only from the public sources listed above. Noevika adds structure, deduplication and enrichment; it does not add claims.
How quickly does a report appear?
Within about thirty minutes of the source publishing it. Regulatory filings carry the regulator’s report date, which can be weeks after the breach — that is why the default list is ordered by when Noevika found an item, with an option to order by the source’s date.
Is a ransomware “claim” a confirmed breach?
No. A claim is a group’s assertion posted on its leak site. Noevika records that the claim was made and when, never the content; confirmation, if it comes, arrives through the news and regulatory sources and appears on the same timeline.
What does the EPSS percentage mean?
FIRST.org’s model-estimated probability that a vulnerability will be exploited in the next thirty days, updated daily. It is a prioritisation signal, not a measure of severity.
Why is an organisation listed twice?
Pages group reports by the organisation name as each source published it. Different legal names for the same entity may appear as separate pages; normalisation handles suffixes and “d/b/a”, not mergers or brand names.
What do watchlists match?
Organisations are matched on the normalised name. Keywords are matched against report titles and summaries — a vendor, a product, a CVE identifier, a technique. Alerts go out once per ingestion run, so several matches arrive as one message.
I already follow these sources by RSS. What does Noevika add?
RSS is the right tool for following a publication, and Noevika offers its own feeds for exactly that reason. What a reader cannot do is recognise that three items from three sources, weeks apart, describe one breach — or tell you that a vendor you depend on has just been named. Noevika stores each report as structured data: it merges reports of the same event, attaches them to the organisation and the threat actor involved, scores the CVEs, and can watch the record on your behalf. The questions it answers are the ones that span sources and time: has this organisation filed before, what is this group doing in my sector, is this vulnerability actually being exploited, did anyone report on my supplier today.
Can I still use my RSS reader with Noevika?
Yes, and it is a good way to use it. Every list on the site has an Atom feed — all incidents, one sector, one organisation, one threat actor — so you can subscribe to the deduplicated record the same way you subscribe to any publication, and keep your reader as the single place you look. Look for the small “Atom feed” link at the top of the incidents list (it follows whatever sector or type filter you have set) and on every organisation and threat-actor page. If you would rather show the list on your own site than read it in a reader, the Embed page gives you a one-line snippet. Either way, every item carries the link to the original publisher.
Can I use the data elsewhere?
Yes. The Atom feeds, the JSON interface and the widget are open and free. Please keep the attribution to the original publisher; it is what the sources are owed.
What does it cost?
Nothing at present.
Who runs it?
An independent project. Questions and corrections: hello@noevika.com.

Sources are checked every 30 minutes. Questions or corrections: hello@noevika.com.