Unauthorised access, from first foothold to leak-site listing. Every file carries a confidence grade, an artefact count, and the questions we have not answered yet.
The Defense Manpower Data Center said unauthorised users had access from October 2025 to 16 July 2026. Letters went out on 18 September. The data was unencrypted: Social Security numbers, birth dates, race, occupational specialty, for service members, civilians, contractors, retirees and families.
The images were not taken. The table that turns 490 million private IDs into links was, with the uploader’s IP and whatever the OCR read.
The seller had a count, a field list and a mechanism. The filing had none of them. Both describe the same theft.
The lawful-request desk checks the domain, and the domain was real. Passports, selfies and a year of transactions went out by reply.
Sixteen months with valid logins, used to poach customers. Those who phoned to check the notice were told it was spam.
Handed to a doorman, kept by a vendor, sold by the hundred thousand a day. A licence number can be reissued; the scan cannot.
Parking, lounges and Wi-Fi — the retail layer where an airport actually knows who you are, and when you are away.
The dump verified at half the claim, and the other half was manufactured. Counting now requires forensics, not arithmetic.
Valid logins, queried at scale, from a register no taxpayer can leave. The forum listing preceded the state’s confirmation.
One fulfilment provider, disclosed brand by brand over weeks. Some customers found out when the parcel did not come.
Nine million faces, indexed for matching, readable by anyone with the URL. Nobody in the store was ever a customer.
The exposed cohort left between 2016 and 2018. The careers site was still holding them, and nobody had a reason to know.
19 million patients, 12,000 clinics, 2.5 terabytes — and a government that will not call it an attack.
The wallet kept the keys safe. The shipping partner’s analytics tool gave away who owns one, and where they live.
A dispute about volume is a dispute about the wrong axis. Ask instead which fields can be reissued.
Three compromised laptops, corporate data taken, and a filing that answers the shareholder question only.
Materiality asks whether an investor would want to know. Whether patients are harmed is a different question.
It does not mean SQL injection is rare. It means the disclosure regime records who was affected and not how.
Abbott confirmed unauthorised access to a limited number of systems. ShinyHunters claims thirty million rows. Almost everything in between is unestablished.
The final count on the Conduent intrusion landed above 62 million people — third-largest in US healthcare history, at a processor most of them have never heard of.
Customer data leaked at a retailer serving 4.8 million. That figure is the customer base, not the affected count — and the distinction keeps getting lost.