Seventeen Million Patients Depended on One Supplier Most Had Never Heard Of

This file states plainly a structure the corpus has recorded across nearly every sector.

The organisation holding the largest population in any sector is generally the one with no relationship to any of them.

Healthcare: 25 million at a back-office administrator, at 25-0801, against 5.5 million at the largest health system, at 25-0308. Now 17 million patients in scope of a GP software supplier, at 25-1214b.

Education: 62.4 million students claimed at one platform, at 25-0105. Finance: 74 institutions through one analytics vendor, at 25-0814; major banks through one servicing vendor, at 25-1112b. Hospitality: three hotel brands through one management platform, at 25-0123b. Local government: three boroughs at once, at 25-1125b.

A consumer-facing organisation is bounded by the customers it can serve. A supplier to those organisations is bounded only by how many of them it can sell to, and specialisation makes that number large.

The corpus filed the economics at 25-0801: efficiency drove the consolidation, the efficiency is real, and the security consequence was never priced into the outsourcing decision because it falls on people who are not party to it.

Affected-count league tables rank the wrong organisations. The largest exposures are at suppliers, and a supplier’s figure is frequently reported as reach — 17 million patients whose GP uses the software — rather than as confirmed exposure.

This desk drew the reachable-taken-published distinction at 25-0717 and applied it again above. Applied to supplier incidents it matters more, because reach at a supplier is enormous and confirmed exposure is frequently much smaller.

They cannot evaluate the supplier, did not select it, are usually not told its name until a notification arrives, and cannot take their data elsewhere — because the relationship that produced the data was with a practice, a school or a bank.

Graded medium: this is a synthesis across the database rather than a finding from a source, and the corpus’s own coverage is shaped by what gets disclosed.