What a Claim Becomes When It Is Finally Tested

This corpus grades attacker figures as claims. Enough of those claims have now reached publication that the corpus can look at what happens when one is tested.

159GB at SIAD, at 25-1111. 343GB at Under Armour, at 25-1001. 43GB at Saint Paul, at 25-0815. 1.3 terabytes at a university, at 25-1012.

When material is published, nobody re-weighs it. The figure was chosen because it sounds large, it is never checked, and the corpus keeps recording it because it is the only number on offer.

At Under Armour, publication produced tens of millions of email addresses — a real and substantial dataset. The claim was not fabricated.

It was also not what the headline implied. A large volume of the least sensitive field is compatible with 343GB and tells a customer very little about their own exposure. The corpus filed the same at 25-1130: order history describes a person; an email address identifies them.

"No evidence of misuse" is technically accurate and unearned, because 25-1219 established that no mechanism connects a breach to a subsequent fraud. Neither party can be checked.

So the public record of an incident is generally two unverifiable assertions pointing in opposite directions, with journalists choosing which to lead on.

Record the claim, label it, give the source, and grade the file on what is established rather than on what is alleged — which is why 25-1001 is graded low despite being one of the largest reported retail exposures of the year.

It is not a satisfying answer. It is better than the alternative, which is quoting a gigabyte figure in a headline and letting it stand as the record.