Official incident notices

When a company has a security incident it publishes one verified notice on Proof Rail. Check any refund, compensation or support link or message against it.

Anyone who received a message or link about a company's incident, and companies that need one official place to point people to.

1. Go to proofrail.me/notices and open the company's notice, or follow the link the company shared.
2. Read the status badge: Active means the incident is ongoing; Resolved means it is over and the notice stays for reference.
3. Use only the links under Official links. They are the only links on the page that leave Proof Rail, and each is on a domain the company has proved.
4. Read the We will never list. A message that asks for any of those things is not from the company.
5. Got a message or link? Paste it into Check it at the bottom of the notice. You get one of three answers: listed in the notice, not listed, or the company has no active notice.
6. Check the Updates timeline for the latest information. Earlier entries are never changed or removed.

Listed in the company's notice.

The link or handle you pasted is one the company put on its verified notice.

Not listed in the company's notice.

The company has an active notice and this is not on it. Treat it as unsafe. If the domain looks like the company's but is not, the answer says so.

The company has no active notice.

There is nothing to compare against, so this answer confirms nothing either way.

Verified domain

A website the company proved it controls with a DNS challenge. Only such domains can appear under Official links.

Content hash

A fingerprint of the published notice, signed with Proof Rail's key. If the page is altered, the hash no longer matches.

• The public index of active and resolved notices.
• The Is this real? check also shows a notice panel when a link relates to a company with an active notice.

• Only a company with an active, public official channels record and a verified website can publish. Once published, the title, summary, links, handles and We will never list are locked; only updates can be added.
• Messages that pretend to be from the company often arrive within hours of an incident. The notice exists so you have one official place to check them against.
• Nothing you paste into Check it is stored.
• A company's newer notice replaces its older one automatically; the old page says so and links to the current notice.
• A Proof Rail reviewer looks at a company's first notice within four hours of it going live. The notice is live from the moment it is published; the review does not hold it back.