Carriers, administrators and the market that prices everyone else’s failure. Half the files here are breaches at insurers, where the record holds a Social Security number next to a diagnosis; the other half are the policies, exclusions and penalties that decide who pays after any breach.
For 17 months the auto-quote form combined a visitor’s name, birth date and address with broker data and returned the driver’s licence number, including for people who never applied. Final approval came on 10 September, fourteen years after Nationwide’s quote form produced the first file of its kind.
6.9 million driver’s licence numbers, a field that is neither ceremonially protected nor practically replaceable.
A containment shutdown that locked members out of retirement accounts, and a credit union suing its own provider over the standards it contracted for.
Most of 1.4 million customers, advisers and employees. A CRM accumulates every population an organisation tracks, and so does its blast radius.
Payments down 44%, claims up 40%. An ecosystem earning less per victim has an obvious incentive to increase volume.
Ransomware is 28% of claims and 52% of the money. BEC is the most frequent and among the cheapest. They need separate budgets.
The exempted system is the one attackers find and the one that voids the policy. The exemption register is now a financial document.
Aggregate premium fell while individual quotes rose 15–20%. The correction lands hardest on those least able to fund controls.
Reachable, taken, and published are three populations. Almost every affected count in this database is one of them without saying which.
A caller claiming to be an agent locked out before a client meeting is making a request the function exists to grant, dozens of times a day.
The reporting duty tracks the sensitivity of the record. The security expectation tracks the sector of the company.
A service desk supporting agents and brokers is supporting people it does not know by sight.
The peer-warning argument only helps organisations that are not first. Hindsight makes May look like August.
An insurer knows every provider seen and every prescription filled. A more complete history than any clinician holds.
An open API at 25,000 queries a day and an agent portal with a password and nothing else. The first time a regulator priced the quote form.
Underwriting a life policy means knowing who someone is and what is wrong with them.
The threat was not publication but the share price. The company refused, confirmed 5,000, and told 850,000 more it could not rule them out.
Authentic data does not authenticate the story told about it. The records check out while the account does not.
A leak site is a shop window. A chat bot is a vending machine — no negotiation, no gatekeeper, just look somebody up.
No evidence, then 36,000, then 2.5 million. Three accurate statements about one intrusion, and the operator was gone before the last one.
One administrator, a page of carrier names, six million people who had never heard of it. The count took seven months and the settlement is under $3 each.