OWASP Web Hacking Incident Database
OWASP Web Hacking Incident Database - An OWASP incubator project
WHID only tracks media reported security incidents that can be associated with a negative impact to a public web application (such as downtime, data leakage, planting of malware, etc…). We also try to limit the database only to targeted attacks, though the distinction between targeted and non-targeted attacks is grey.
The database does not include known vulnerabilities in web based applications, an area well covered by other databases such as CVE. WHID does not include incidents in which web site were breached using operating system or network layer vulnerabilities.
We also consider most web site defacements as non targeted attacks and we do not include them in the database. We will, however, include defacements of high profile websites. For information about web site defacements refer to zone-h.
As those criteria are somewhat subjective, we welcome comments on the inclusion or exclusion of publicized security breaches.
The criteria for inclusion into WHID as mentioned above is a bit strict. The goal is to list only incidents that are related to web application layer compromises by threat actors. The goal is to show that application layer security is a risk that cannot be ignored regardless of the perceived value of the website.
Keep in mind, that while there are countless website hacks, the vast majority are not reported. Even for those reported most of the time it is difficult to tell how exactly they occurred (attack methods).
Specifically addressing the defacement incidents reported in zone-h, bear in mind that in nearly all of these incidents there is no public information on the way in which they were carried. Additionally, many defacements are not targeted and are the result of a wide scan for vulnerable sites and therefore we do not normally include defacements in WHID.
The reason is probably that the incident did not occur due to a web application vulnerability, or there was not direct impact (outcome). For example probably the most well known information security breach ever, the CardSystems incident was added only in April 2006, nearly a year after it was initially publicized. While we always suspected that it was a web hack and industry rumors hinted that, no public information regarding the way in which the hack was done was available until April 2006. Actually the CardSystems incident was brought in previous versions of this FAQ as an example of an incident that we would like to add to WHID but cannot. For other hacks such information is not available and may not become available in the future.
The data collected is NOT reported directly to OWASP/WASC but is rather collected from public sources, mostly technical media, mailing list post and researchers advisories. As a result the reliability of the reported information depends on the source. Since the source (or sources) is included with each entry, the reader can assess its reliability independently. We do however assess the source before including an incident in the database and if for whatever reason something we added to the database is found to be erroneous, we remove it, though this has ever happened to date.
For media reported incidents, we’re trusting that the reporter or news outlet verified the information. For mailing list reported incidents and research advisories, these issues are normally quickly confirmed our refuted by other subscribers or by the offended vendor. In case of doubt evaluate the level of information provided in the disclosure and the publishing history of the researcher.
WHID includes “breaches” but not “disclosures”. Breaches are incidents in which a web site was compromised, while disclosures are incidents in which a researcher published a vulnerability in a web site. In other words, breaches are incidents in which we know bad guys took advantage of a vulnerability, while disclosures are incidents in which whitehat hackers disclose the vulnerability details. WHID is focused on compromises by real threat actors.
Some of the incident attack methods are classified as “Unknown”. You may wonder why were these incidents included in the list, as there is no way to know that the hacker exploited a web application vulnerability. In some cases the public information available indicates that the incident exploited a web application vulnerability, and in others we deducted from the available information. This important inclusion criteria for WHID is a negative impact to a web application or its data. Attack Method and Application Weakness may be listed as Unknown if those details are not available.
Project Resources
Project Leaders
4ng3l hacker
Project Leader
Project Information
Incubator Project
Classification
Other
Language
HTML
Contributors
3
GitHub Stars
2
Downloads
0
Corporate Supporters
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
Quick Links
Legal & Governance
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.