An attack identifier is a code, hash, tag, or reference used to label a reported or claimed security incident. It helps analysts track one event across posts, logs, tickets, and threat-intelligence systems even when the underlying details are incomplete or disputed.
In cyber security, identifiers matter because they let defenders group related activity, compare claims, and avoid confusion when multiple reports describe the same target. A ransomware group may attach an identifier to an extortion post, while defenders may map that code to internal alerts, forensic artifacts, or case records. This supports triage, correlation, and communication, but it does not prove that a breach really happened. An identifier is useful metadata, not evidence by itself.