A discovery date is when an issue is first noticed or detected. It is not necessarily the date the incident began: an intrusion, data exposure, or malware infection may have been present for days or months before anyone identified it.
In cybersecurity, this distinction matters for incident timelines, impact assessments, and reporting. During ransomware triage, a date in a criminal claim or a copied listing may be unverified and should not be treated as proof that an attack occurred then. Defenders compare reported dates with system logs, alerts, forensic artifacts, and other corroborating evidence, while recording uncertainty until the timeline is supported.