Public interest starts before every answer is known.
A company can identify unauthorised access before it knows the total number of people involved. It can notify customers while a forensic review is still in progress. Regulators can open an investigation while evidence is incomplete. None of those events makes a final finding; each can still matter to people who may need to secure an account.
That is why KR Data Watch uses Investigating as a distinct status. It records a material public report, names the uncertainty and links the evidence. It is not a label for treating an allegation as a confirmed fact.
Three labels, three meanings.
Confirmed means a company, regulator or other clearly attributable primary source has disclosed the record. Investigating means an incident has been materially reported but the scope remains open. Claimed means a public allegation exists without independent confirmation. The source note and evidence timeline explain why each record is where it is.
This distinction is especially important with ransomware claims and social-media posts. A leak-site post may be a warning signal, but it can be recycled, fabricated or unrelated to a current personal-data exposure. Readers should be able to see that difference at a glance.
What to do when the status is not final.
Do the low-regret things first: use a unique password, turn on stronger sign-in protection, and do not click follow-up messages about the incident. Avoid assuming that every account is affected unless the organisation says so.
Then monitor the linked sources and the dated timeline. A responsible index should update the status as evidence changes, preserve the record of that change, and accept corrections. That is how an early warning remains useful without becoming a rumour amplifier.