Methodology & Codebook
Cyber Events Database Documentation
August 2025 (Revised to incorporate GDELT NGRAMS and GDELT Article List)
The increasing scale and impacts of cyber events remain an enduring concern. Yet, information covering the range of threat actors, motive, industry, or classified impact is scarce, fractured, or is only available through private organizations at a significant cost. The Cyber Events Database collects publicly available information on cyber events from 2014. It was created to address a lack of consistent, well-structured data necessary for making strategic decisions about how to invest resources to prevent and respond to cyber events.
The Cyber Events Database allows users to distill analytical insights on cyber threats to specific industries and regions, trends over time, and the behavior of different threat actors. By leveraging GDELT's Web News NGrams 3.0 and Article List datasets, the database draws from a comprehensive, real-time global news monitoring system to enhance coverage and timeliness of cyber event data.
Data is collected using a mixed-methods approach that integrates a Python script (using internal libraries csv, datetime, urllib, requests, json, and external library Beautiful Soup 4) to scrape data from known open internet and dark web sources, accessing main landing pages and RSS feeds via predetermined URLs to extract date published, title, URL, article preview, local date/time of access, and overarching website title in HTML format.
Concurrently, the supplemental script leverages the GDELT Project's Web News NGrams 3.0 Dataset, performing keyword searches (e.g., "cyber attack," "data breach," "ransomware") on real-time unigrams and higher n-grams from millions of news articles across over 60 languages, joining matches with the GDELT Article List to retrieve article URLs, publication dates, titles, previews, and metadata (e.g., language, source domain).
Cyber Event Definition
A cyber event is defined as the result of any single unauthorized effort, or the culmination of many such technical actions, that engineers, through the use of computer technology and networks, achieve a desired primary effect on a target. The dataset chiefly records individual cyber events where a discernible effect was achieved by the threat actor (e.g., hacker).
All data is processed into two .csv files—one for scraped web data and one for GDELT-derived data—which are deduplicated daily and reviewed by researchers to (1) ensure events meet the definition of a cyber event, (2) categorize threat actor type, motive, threat actor country, and targeted country, and (3) classify affected industry and effects based on a structured taxonomy. Attributions are taken directly from source material without independent validation.
The script, fully functional in Python 3.8 or higher, supports querying GDELT's historical data from 2014 onward with real-time updates every 15–60 minutes, though GDELT integration into this CEDB begins in CY 2025.
Criminal
Organization that illicitly accesses networks for financial gain.
Nation-State
A government agency, military, or affiliate thereof
Terrorist
A non-state actor seeking to influence political or military conditions by targeting civilians
Hacktivist
An individual or group motivated by social or political activism
Hobbyist
An individual motivated by curiosity or prestige
Protest
The disruption of services in order to send a political or social message to the target organization, or to a government or population indirectly.
Sabotage
The intentional, irreparable destruction of information, networks, or devices
Political-Espionage
Accessing networks for the purposes of intelligence, surveillance, or gaining political advantage.
Industrial-Espionage
Accessing networks to steal trade secrets, intellectual property, or competitive business information.
Financial
Exfiltrating sensitive data for direct or indirect financial gain.
Reputation
Attacks intended to damage the reputation or credibility of the target organization or individuals.
Personal Attack
Targeted attacks motivated by personal grievances, revenge, or harassment against specific individuals.
Disruptive
Impedes the target organization's normal operations
Exploitive
Illicitly access or exfiltrate sensitive information such as personal identifiable information, classified information, or financial data.
Mixed
Event incorporates both disruptive and exploitative elements, such as a ransomware attack.
Message Manipulation
Interference with the target organization's ability to accurately present or communicate information to its customer base, constituency, or other audience.
Examples: Hijacking of social media accounts, website defacement
External Denial of Services
Executed from devices outside of the target organization's network to degrade or deny its ability to communicate with other systems.
Examples: DDoS attacks (ICMP flood, SYN flood, ping of death), BGP hijacks
Internal Denial of Services
Executed from inside a target organization's network to degrade or deny access to other parts of the IT network.
Examples: Resetting core routers, installing malware on file servers
Data Attack
The manipulation, destruction, or encryption of data in a target organization's network.
Examples: Wiper viruses, ransomware, data manipulation
Physical Attack
The use of IT components, such as SCADA systems, to manipulate, degrade, or destroy physical systems.
Examples: Manipulation of PLCs, attacking industrial control systems
Exploitation of Sensors
The theft of data from a peripheral device, such as a credit card reader, smart TV, or baby monitor.
Example: Target corporation PoS compromise (40M+ credit card numbers)
Exploitation of End Host
The theft of data stored on user's desktop computers, laptops, or mobile devices.
Examples: Malicious links, compromised user credentials
Exploitation of Network Infrastructure
The theft of data through direct access to networking equipment such as routers, switches, and modems.
Example: VPNFilter malware affecting 500,000+ routers worldwide
Exploitation of Application Server
The use of a misconfiguration or vulnerability to gain access to data in a server-side application (e.g. a database) or on the server itself.
Examples: OPM data breach (SQL injection), Sony Pictures email server breach
Exploitation of Data in Transit
The acquisition of data moving between devices.
Example: Unencrypted data over unsecured wireless networks
Organization Memberships: Binary fields indicating target country membership in NATO, EU, Shanghai Coop, OAS, Mercosur, AU, ECOWAS, ASEAN, OPEC, Gulf Coop, G7, G20, AUKUS, CSTO, OECD, OSCE, and Five Eyes.
Center for Governance of Technology and Systems
Thurgood Marshall Hall
7805 Regents Drive
College Park, MD 20742
charry@umd.edu (Charles Harry, PhD)
dentrik@umd.edu (Devin Entrikin)