Data & Downloads
The Atlas dataset is open. Export it, inspect the field definitions, and reproduce every derived score yourself.
CSV is a flat, one-row-per-case export (good for spreadsheets). JSON preserves the full nested record structure. Both are generated from the same source data that powers the site. Each file carries the dataset version, last-updated date and record count: in the JSON under meta, and in the CSV as comment lines starting with # (in pandas, read with comment="#"). Data cutoff is the date of the newest case; last updated is the date the records were last changed.
Codebook
Field definitions for the CSV export. Derived scores (unpeace, entanglement) are documented in methodology §06 and can be recomputed from the other columns.
| Field | Description |
|---|---|
| id | Stable unique identifier for the incident record. |
| slug | URL slug (matches /cases/<slug>). |
| name | Full incident name. |
| shortName | Short display name. |
| year | Primary year of the operation. |
| dateRange | Human-readable date range. |
| incidentType | espionage | destructive | ransomware | influence | sabotage | hybrid. |
| attributedTo | Named responsible actor (as publicly attributed). |
| attributionCountry | Attributed state nexus. |
| attributionConfidence | confirmed | high | moderate | low | contested. |
| peakTier | Peak escalation tier: probing…strategic. |
| unpeaceScore | Composite severity, 1–10 (see methodology §06). The site draws it on a 0–100 axis; the export keeps the native scale. |
| entanglementScore | Sector and country spread, 1–10 (see methodology §06). |
| targetSectors | Affected sectors (semicolon-separated). |
| targetCountries | Target countries as ISO 3166-1 alpha-2 codes (semicolon-separated). |
| thresholds | Thresholds crossed, from the closed list (methodology §06; semicolon-separated). |
| significance | Why the case is significant (narrative, not scored; semicolon-separated). |
| governanceFormal | Count of formal governance responses (separate axis, not part of severity). |
| geographicScope | global | nato-allies | central-europe | allied-jurisdictions, when targets are not listed as countries. |
| intrusionSetIds | MITRE ATT&CK group IDs (semicolon-separated). |
| attributionOrgan | State organ named in the attribution. |
| governanceFlags | Governance mechanisms triggered (semicolon-separated). |
| attackTechniques | MITRE ATT&CK technique IDs (semicolon-separated). |
| lastUpdated | Date the record was last reviewed. |
| inclusionCriteriaMet | Inclusion criteria met (methodology §03; semicolon-separated). The guideline is at least 3 of 5. |
| sourceUrls | URLs of sources that have a stable official page (semicolon-separated). |
Changelog
2024-12
Landmark cases (NotPetya, SolarWinds, Stuxnet, WannaCry, Viasat KA-SAT) reviewed; verified primary-source URLs and additional academic/journalistic references added; per-record review dates set.
2024
Dataset expanded with 2024 operations and additional globally-sourced and attribution-focused cases.
2023
Initial corpus assembled: 20 seed cases across escalation, infrastructure, and governance lenses.
Candidate cases under consideration are tracked in docs/dataset-todo.md and are not added until fully sourced.