Transparency
Confidence is not binary.
Rift separates observation, corroboration, and confirmation. A criminal post is a signal — not proof.
Reliable independent evidence
Confirmation by the affected organization, a regulator, authority, CERT, or a breach database with an editorial verification process.
Two or more independent sources
Consistent signals exist across distinct sources, but primary confirmation is still insufficient.
Observed from an actor or aggregator
The event was posted by a threat actor or mirrored by an OSINT source. It may contain errors, exaggeration, duplication, or incorrect attribution.
We collect
Organization, alleged actor, time, source, category, and aggregate impact.
We do not collect
Leaked files, credentials, raw PII, samples, or download links.
We correct
Events are reclassified when stronger evidence becomes available.