Software Supply Chain
Claimed Versus Verified
Also: unconfirmed breach claim
The habit of recording separately what an attacker or rumour says happened and what the affected company or independent researchers have confirmed.
In more detail
Dark-web listings and social posts are sometimes wrong or inflated. A good incident write-up labels each fact with its source and status, so you can decide whether to rotate a key now because rotation is cheap, without treating a claim as a confirmed breach.