About

Nothing in this catalogue is invented. Every exhibit is a real incident — a worm, an exploit, a breach that actually happened — and every string printed on a garment was checked against primary reporting before the file went to production. Where a figure is contested, the exhibit names the figure it is using or carries no number at all.

Who writes this

The Archive is written and fact-checked by a practicing senior security engineer. The name stays off it, which is ordinary in this field and deliberate here: the work is meant to be judged on whether the details hold, not on a byline. Every article is published under UNHACKED, and UNHACKED is accountable for it.

In practice that means whoever writes an entry reads the incident report, not the summary of the incident report.

How the Archive is written

• Primary sources first. Vendor advisories, CVE records, court filings, indictments, post-mortems and the researchers' own write-ups. An encyclopedia is a way to find those documents. It is never the citation.
• The famous number gets interrogated. ILOVEYOU's ten billion dollars, Y2K's hundred billion, Heartbleed's "two-thirds of the web" — every one of those has an origin, and most of them are softer than the headline. The Archive says where the number came from instead of repeating it.
• Sources are listed and checkable. Every entry ends with the documents it was built from.
• Exact, or absent. 807–1210 Hz. 63,000 rpm taken to 84,600. Sixteen of one hundred and nine functions. A domain that cost $10.69. If a detail cannot be verified to that standard, it does not appear.
• Corrections are made in place. An entry that turns out to be wrong is fixed on the page, not quietly deleted.

Why it exists

Because the popular version of most of these incidents blames the person who clicked. ILOVEYOU spread through offices that had known file extensions hidden by default, so LOVE-LETTER-FOR-YOU.TXT.vbs arrived looking like a text file. Over 98% of WannaCry infections ran Windows 7 — supported, patchable, and unpatched eight weeks after the fix shipped. Y2K was not laziness; two-digit years were a storage decision made when storage was the expensive part.

The user is not the story. The default is.

Each design is catalogued the way the incident deserves — EXHIBIT 0001, EXHIBIT 0002, and onward — because that is what these are. Not merchandise about hacking. A record of specific failures, printed at wearable size.

Read the Archive · View the catalogue · Contact

Not one of these was carelessness. Every one was a default that came due.