Boyd Gaming Reached the Public Record Through a Securities Filing

At 25-0502 this desk set out four filters deciding which incidents anywhere become part of the public record: a mandatory disclosure obligation, collective redress, a security research industry, and publication in English.

Boyd Gaming at 25-0923b entered through none of them. Employee data would not trigger consumer notification. It reached the record because a listed company assessed an incident as material and filed with a securities regulator.

It follows materiality to investors rather than sensitivity to individuals. That produces coverage this corpus otherwise lacks — the postponed earnings release at 25-0526, the £196 million booked cost at 25-0902, the $180–400 million estimate at 25-0530, the employee data here.

Every one of those is a fact the data-protection regime would not have surfaced.

Listed companies are large, and the filter selects for them. A private company with identical employees, data and exposure has no equivalent trigger.

The corpus already knew it over-represents large organisations — the size-threshold observation at 25-1005, where a 4,541-person breach was small enough that most compilations would not mention it. This names a mechanism producing it.

A small private company passes none of the five filters. No securities filing, frequently below notification thresholds, no class action worth bringing, not covered by research vendors, not written up in English or otherwise.

Whatever happens to small organisations is close to entirely invisible to this database, which is the subject of the files at 25-0610b and 25-0613b. Graded medium: this is an addition to an earlier structural argument, not a finding from a source.