Insider Threat Matrix™Insider Threat Matrix™
  • ID: IF040
  • Created: 22nd July 2026
  • Updated: 22nd July 2026
  • MITRE ATT&CK®: T1565T1565.001T1565.002T1565.003
  • Contributor: The ITM Team

Data Integrity Manipulation

The subject inserts, deletes, alters, substitutes, suppresses, or misrepresents organizational data in a manner that compromises its accuracy, completeness, authenticity, or reliability. The manipulation may affect stored records, data moving between systems, or information generated and presented while an application is operating.

 

Data integrity manipulation may be intended to influence a business process, conceal activity, mislead stakeholders, obtain personal benefit, cause operational harm, or undermine organizational decision-making. Affected information may include financial records, customer data, operational measurements, transactions, case records, communications, database entries, system outputs, or other information relied upon by the organization.

Subsections (3)

ID Name Description
IF040.002Data in Transit Manipulation

The subject intercepts, alters, substitutes, suppresses, or redirects organizational data while it is moving between systems, applications, processes, interfaces, devices, or recipients. The destination consequently receives information that differs from the data originally transmitted.

 

The behavior may affect network traffic, application programming interface messages, middleware, message queues, email transport, print workflows, clipboard operations, transaction instructions, or other data-transfer mechanisms.

IF040.003Runtime Data Presentation Manipulation

The subject modifies an application, executable, library, extension, runtime component, or processing pathway so that organizational data is altered as it is accessed, processed, rendered, or displayed.

 

The underlying stored data may remain unchanged while an operator, customer, investigator, or decision-maker is presented with inaccurate, incomplete, suppressed, or substituted information. The behavior may conceal transactions, alter displayed values, omit selected records, or cause an application to present information that differs from its authoritative source.

IF040.001Stored Record Manipulation

The subject inserts, deletes, alters, substitutes, or suppresses data retained within an organizational system so that the authoritative record becomes inaccurate, incomplete, misleading, or unreliable.

 

Affected information may include database entries, business records, documents, stored communications, transactions, customer records, inventory values, measurements, or case information.