# Claim-Grading Kit: Corroborate a Breach Headline Before You React

**Purpose.** This kit helps you read a scary breach story the way an analyst would: split it into separate claims, count the independent sources behind each one, grade each claim honestly, and decide what to do. It's built around the Binance $6.34 billion story, where two outlets carry the headline figure and the vivid AI-abuse detail rests on one. Print it, fill it in, and keep it with your incident notes. Everything here works with free public sources and a notes file.

## Checklist: evaluating any breach or incident story

- [ ] Write the headline claim on one line in your own words.
- [ ] Split it into separate claims (loss amount, entry method, role of any AI or tool, attacker identity).
- [ ] List every outlet carrying each claim.
- [ ] For each outlet, mark whether it shows its own evidence or repeats another outlet.
- [ ] Look for repeated wording, identical figures or the same quoted statement. Two outlets citing one disclosure count as one source.
- [ ] Compare figures across outlets and note small mismatches (for example $6.34 billion versus roughly $6.3 billion). Ask which had the original data.
- [ ] Note who benefits from the framing (a vendor selling protection, an outlet chasing clicks, a party under pressure).
- [ ] Write down what is missing. The most important gap is usually the technical detail behind the most vivid claim.
- [ ] Grade each claim Confirmed, Reported by one outlet, or Unverified. Grade on evidence shown, not on plausibility.
- [ ] Choose confidence language (see cheat sheet) before you write to staff or customers.
- [ ] Pick no-regret controls that pay off whichever version proves true.
- [ ] Set a reminder 2 to 4 weeks out to look for a post-mortem or regulator filing, then re-grade.
- [ ] Do not repeat unverified details to staff or customers as fact. Share the verified lesson instead.

## Worksheet: claim-grading table

The first four rows are filled in as a model from the Binance example, graded from the Apprised.news tech desk brief of 4 November 2026. Copy the table and fill in your own rows for the next story.

| Claim | Outlets | Original or repeat? | Evidence shown | Confidence | What would change my mind |
|---|---|---|---|---|---|
| Loss of about $6.34 billion | Security Affairs ($6.34B); Atlantic Council (roughly $6.3B) | Unclear; figures differ slightly | Figure stated, no primary document seen in the material | Moderate | Binance post-mortem or regulator filing confirming the figure |
| Entry via fake job interviews and compromised developer tools | Security Affairs | Single outlet | Asserted; plausible hiring-channel route | Low to moderate | A second outlet with original reporting, or Binance's own account |
| Abuse of an internal AI system | Security Affairs | Single outlet | No technical description of what the AI did or could access | Low | Post-mortem naming the AI's permissions and scope |
| Attacker identity | None | Not applicable | None; the desk's analysts decline to name an actor | Unverified | Attribution by the affected company, a regulator or credible forensic firm |
| (your claim) | | | | | |
| (your claim) | | | | | |

## Confidence-language cheat sheet

**Use:**
- "Reported by [outlet]; we have not seen confirmation."
- "Consistent with [explanation], though the evidence does not rule out [other]."
- "Two outlets carry this, and they may share one source."
- "Moderate confidence in the figure, low confidence in the mechanism."
- "I would change my view if [specific new evidence] appeared."

**Avoid:**
- "It was [cause]" when only one outlet says so.
- "Everyone is reporting" when the reports trace to one disclosure.
- "Proves" or "confirms" for anything a single outlet asserts.
- Repeating an attacker name or technical mechanism you have not seen supported.

## Template: analysis of competing hypotheses

Fill in the hypotheses and evidence from your own sources. Mark each cell C (consistent), I (inconsistent) or ? (unknown).

```text
Incident: ______________________________

Hypotheses:
H1: ___________________________________  (example: funds-only theft via human-and-tooling entry)
H2: ___________________________________  (example: wider exposure including internal data or IP)
H3: ___________________________________  (example: reported mechanism is overstated)

Evidence items (source in brackets):
E1: ___________________________________ [ ]
E2: ___________________________________ [ ]
E3: ___________________________________ [ ]

Matrix:        H1   H2   H3
E1             _    _    _
E2             _    _    _
E3             _    _    _

Single missing fact that would best separate the hypotheses:
______________________________________

Where to look for it (post-mortem, regulator filing, second outlet): ____________
```

## No-regret controls (worth doing under any version of the story)

- [ ] Open files from candidates and strangers only in a disposable browser profile or a cloud viewer, never on a machine signed in to your customer or payment systems.
- [ ] Remove standing admin rights from developer and finance machines.
- [ ] Treat every AI assistant as a privileged identity. List what it can read, write, export and spend.
- [ ] Give each AI assistant the narrowest permissions it needs.
- [ ] Require human approval for any money movement, refund above a small limit, or export of customer data.
- [ ] Patch internet-facing devices named in current exploited-vulnerability alerts.
- [ ] Tell staff the verified lesson, not the unverified mechanism.

## Template: follow-up reminder

```text
Date set: ____________    Re-check on: ____________ (2 to 4 weeks out)

Story: ______________________________
What I am waiting for: post-mortem / regulator filing / second outlet with original data
Where I will look: ______________________________

When I re-check, I will:
1. Re-grade each claim in the table above.
2. Note any claim that moved from Reported by one outlet to Confirmed.
3. Note any claim that was walked back.
4. Update what I tell staff, if anything.
```

## Prompts (ready to paste)

```text
Here is a news article about a breach: [paste text]. List every distinct factual claim in it. For each claim, tell me whether the article gives its own evidence, cites another outlet, or cites no source. Do not judge whether the claims are true; only map where each comes from. If you are unsure about any item, say so rather than guessing.
```

```text
I have two articles about the same incident: [paste A] and [paste B]. Build a table of claims, which article makes each claim, where the figures or details differ, and whether the second article appears to be independent reporting or a rewrite of the first. Flag anything I should verify from a primary source. Work only from the text I pasted, and tell me when you cannot tell.
```

```text
Using low, moderate and high confidence, help me grade these claims about a breach: [paste claims and which outlets carry them]. For each, write one sentence on the evidence, one on what is missing, and one on what new information would raise or lower my confidence. Use only the material I gave you, and mark anything you are unsure about.
```

```text
Run a simple analysis of competing hypotheses on this incident: [describe it using only facts from the sources I pasted]. Give me three or four explanations, a list of evidence items, and a matrix showing which evidence each hypothesis is consistent or inconsistent with. Point out which single piece of missing evidence would discriminate best, and say where you are guessing.
```

```text
My business uses these tools and AI assistants: [list them with what each can access, from my own admin screens]. Based only on the lesson that an internal AI assistant should be treated as a privileged identity, propose the narrowest permission set for each and a human-approval rule for any action that moves money or exports data. If you lack information about a tool's settings, say so instead of assuming.
```

## Sources

- https://apprised.news/desk/tech/2026-11-04
- https://securityaffairs.com/202369/cyber-crime/binance-hack-how-fake-job-interviews-and-ai-abuse-led-to-a-6-34-billion-attack.html
- https://www.atlanticcouncil.org/blogs/econographics/a-6-billion-hack-in-a-season-of-ai-anxiety/
- https://www.bleepingcomputer.com/news/security/hackers-hijack-cpguard-autoupdate-to-deploy-backdoor-steal-data/