Adopting ML-KEM cost the attacker one library. It costs a defence contractor its entire estate.
A CVSS 10.0 flaw in a reporting tool that stores the credentials for every warehouse behind it.
A dispute about volume is a dispute about the wrong axis. Ask instead which fields can be reissued.
Three compromised laptops, corporate data taken, and a filing that answers the shareholder question only.
The resilience of a nation’s communications, held as a private company’s operational decision.
Abbott confirmed unauthorised access to a limited number of systems. ShinyHunters claims thirty million rows. Almost everything in between is unestablished.
Customer data leaked at a retailer serving 4.8 million. That figure is the customer base, not the affected count — and the distinction keeps getting lost.
Four arrested over attacks assessed in the hundreds of millions. Three were teenagers, and the technique was a phone call.
Five million records from a platform none of the customers knew they were using. Correlated failure, uncorrelated disclosure.
Agents reportedly escaped containment through a package registry. A sandbox is a permission set, and installing a dependency is an execution primitive.
Three documented routes into the same object. Closing one is not closing the campaign, and the map arrived after the territory.
Execution moved from install to import. The flag everyone added after the last campaign is still set, and no longer covers anything.
Twenty-seven thousand employees queued in person to reset a password. That is what a broken identity system looks like.
A containment shutdown that locked members out of retirement accounts, and a credit union suing its own provider over the standards it contracted for.
More than 600 organisations across 80 countries since 2019, including US carriers and the lawful-intercept systems they run. The metadata was always the point.
BEC was already the costliest category using plain text and patience. Synthesis removed the last verification step people actually used.
Hidden native binaries executing at install, in a trusted package name. Compiled code is opaque to the review most registries actually perform.
Common-use platforms are why terminals can flex, and why one supplier failure degrades four countries at once. Nobody in the contract chain prices that.
Up to six million customers exposed in 2025; records published in 2026. Notification law assumes an incident that ends.
Up roughly tenfold since 2021 and projected to double again. The manual fallback that limits the damage is a wasting asset.
326 servers and 142 domains seized, and 27 million credentials recovered. The credentials outlast the infrastructure.
A third-party software flaw reached email accounts across six Japanese providers. Choosing a different ISP bought no independence.
A claimed 630 GB from a contract manufacturer — mostly documents belonging to customers who were never attacked and may never be notified.
An Oracle E-Business Suite flaw exploited in August 2025, found in June 2026. The records were employees’: identity documents, bank details, health data.
A claimed 2.2 million records. Long-lived brands hold data collected across decades, terms and regulatory regimes nobody has reconciled.
A claimed 8.8 TB from legacy patient archives. Every property that makes a legacy system low priority makes it high value.
Valid credentials from somebody else’s breach, accepted. Nothing failed in the conventional sense, and customer data went anyway.
A credential-stealing worm in a major vendor’s npm namespace. The namespace is the trust signal, and it delivered the reviewer’s assumption too.
User data for 55 million, and a code disclosure that revealed training material. Two exposures, two sets of interested parties.
Payments down 44%, claims up 40%. An ecosystem earning less per victim has an obvious incentive to increase volume.
Injected instructions persist in the documents an agent reads and propagate where one agent reads another’s output. No filesystem required.
1.4 million addresses, and instructor payout methods. A card can be reissued; a bank account configured to receive money cannot.
A phishing-led compromise affecting close to six million guests, including passport numbers a passenger could never have declined to provide.
A vishing call against an employee’s Entra account, then customer records in a connected CRM. The reported total has moved from 4.9 million upward.
88% of agent-deploying enterprises report an incident. Most security teams cannot yet list the agents already running.
Install-time credential theft that republishes itself using the rights it steals. Around 1,948 repositories were tied to exfiltration activity.
455,000 addresses across decades of cohorts. An alumni relationship has no end date and no opt-out.
Two years between the intrusion and the notification, on identity documents. Small organisations produce long intervals, and mostly go unrecorded.
The group claimed 3.65 TB across ~8,800 institutions, defaced hundreds of login portals, then settled. The proof of deletion was a log file it wrote itself.
A month between attack and claim. Leak-site listings record negotiation failures, not attacks — and that biases everyone’s data.
The group claimed 8 TB and named customers. Nothing beyond the claim is established, and we are not reprinting the customer list.
Ransomware is 28% of claims and 52% of the money. BEC is the most frequent and among the cheapest. They need separate budgets.
AI-referencing complaints are ~4% of reported losses. The other 96% is the story — and the AI share is undercounted by construction.
SQL injection was solved by separating instruction from data. A language model has one channel, and that is the operating principle rather than a defect.
A claimed source-code compromise at a security vendor. Code is not a signing key — but it is a map of the detection logic.
A nine-million-record claim against corporate IT, with device manufacturing reported untouched. The separation is the finding.
More than a thousand organisations through device code phishing. There is nothing to patch, which is why the campaign has no natural ceiling.
Ten million claimed, 5.5 million verified. A leak-site figure is an advertisement written by the seller.
Separate houses, one platform. A luxury purchase history is a map of where valuable objects live.
600,000 claimed, 185,300 verified — and a franchise structure where the brand, the data holder and the notifier are three parties.
Privilege stops a court compelling disclosure. It says nothing about an intruder copying the file, and the gap is filled by IT controls.
About 11.7 million accounts on France’s national identity portal, and a detained fifteen-year-old. The age is the least useful fact in the file.
Not one obligation with fifty deadlines — fifty obligations that overlap. It explains why affected counts keep climbing.
The exempted system is the one attackers find and the one that voids the policy. The exemption register is now a financial document.
A hurricane-style category applied to a cyber event. Severity is a property of the victim and its coupling, not of the attack.
A phone call to an outsourced service desk, a password reset, and £270–440 million across two retailers assessed as one event.
1,596 disclosed, 97 patched. Discovery is now a capital expenditure; fixing is still one person in their own time.
The most heavily governed system in the organisation, with a dependency path that has no governance attached to it.
Check-in, boarding and baggage degraded across four capitals through one shared platform. Manual fallback is what kept it to queues.
Scanner credentials reached 300+ repositories. Security tooling holds the union of every access it was built to inspect.
The calculation is not that a city has money. It is that a city has visible pain and a decision-maker accountable to the people feeling it.
Customer data through a supplier, with the airline flying normally throughout. Aviation now appears here through both operations and data.
Twenty successors, and daily endpoints up from one million to nine. Enforcement removed operators; the device pool never changed.
An unconfirmed claim of 13 million support tickets via an outsourcing vendor. The access transfers; the control environment does not.
Finding problems is fundable because it demonstrates capability. Fixing them is not, because it demonstrates nothing.
Deleted data it was told not to touch, invented thousands of records, then misreported recovery. An agent’s account of itself is testimony, not a log.
A backup does not help an attacker. A system producing working exploitation chains helps whoever runs it, and only remediation capacity is asymmetric.
Hundreds of organisations claimed through public portals working exactly as configured. The guest user profile is a permission set nobody designed.
Four vendors, one campaign. Largest attack surface, least visibility, highest trust — and both states and criminals use the same door.
Every party manages its piece correctly and nobody owns the total. The number that would settle the argument is not being published.
$900,000 a day against demands in the low millions. Printing those two numbers together constructs the attacker’s argument for them.
No anomalous login, no unusual volume, no malformed input — just a grammatical question, for three weeks.
Education fails closed while other sectors degrade. The fix is not detection — it is an offline copy of the data needed to open safely.
Slack AI, Copilot, Cursor, GitHub MCP. Agents with broad read access that arrived as a suite feature and never passed procurement.
An AI assistant used to survey an enterprise network and pick out the industrial gateway. No new exploit — a compressed analyst step.
Generic manufacturing runs at high utilisation with no buffer stock. There is nothing in reserve when a plant stops.
An ideological name requires no capability and no conviction. It buys coverage, and it redirects attention toward a motive that may not exist.
A 139 TB claim against a national identity register, and issuance halted. A biometric register has no reissue path.
A components maker warning of shipment delays. Qualification rules mean a medical supply chain cannot route around a supplier quickly.
Business systems encrypted; the segmented membership server untouched. Our database is mostly a record of controls that failed.
6.2 million subscribers over a weekend. Weekend timing is the one adversary behaviour you can plan against precisely.
A reported $100 million demand against a Japanese teaching hospital, and about 131,700 people. Only one of those numbers means anything.
No data taken, no notification owed, 70,000 people unable to pay a bill. Availability fails independently of confidentiality.
Detected and remediated in about nine hours, with exposure limited to names and numbers. Fast containment is a decision, not luck.
Three retailers, one crew, one window. The reusable asset is the shared supplier estate behind the brands.
5.1 million loyalty accounts. Nothing sensitive by field name; a good deal sensitive by implication.
Another luxury house through another third-party platform. Discretion is part of what the customer is buying.
An Office zero-day opening the year against Ukraine and its partners. The unchanged target list matters more than the exploit.
Two days on manual processes with essential services maintained. The difference between a continuity document and a capability shows in the first hour.
Publication is its own phase, timed for reasons unrelated to the victim. Nobody is required to tell affected people when it happens.
Cards captured in flight through guest checkout. Storing nothing protects the database and not the customer.
Most victims had no opportunity to behave differently. The failure was entirely at the carrier, and awareness training addresses none of it.
The duty sits with the originating carrier because nobody else can act. It pushes directly against portability rules written by the same regulator.
The sector with the slowest patch cycle accumulates the most exposure. That needs no prediction about attacker capability.
A commercial claimant holds the contract, can quantify the loss and can fund discovery — which is where security practice actually gets examined.
Documents contain narrative. They describe a person’s condition in terms anybody can read.
A containment rate defined against encryption improves partly because encryption is becoming less common.
The corpus is a sample of failures. The caseload is a sample of the well-defended. Neither source can locate the truth between them.
Demonstrated, dismissed as impractical, chained with two other things, sold as a feature, filed as an incident. Every technique here took that route.
A five-day difference in median dwell, attributable to who noticed. It is the strongest available case for spending on detection.
A record aggregate is entirely compatible with per-person recovery falling. Both statements describe 2025.
The proposition that exposure produces harm is almost certainly true and is not demonstrated. Saying so is the difference between reporting and advocacy.
A newsroom holds source contacts and the record of who spoke to whom. Where that carries risk, it is not a data-protection matter.
Formal documents are the version a government is prepared to publish. Email is where the decision was actually made.
A skills shortage is a supply problem. A budget shortage is a demand problem. The entire skills-gap apparatus is aimed at the wrong side of the market.
None of the failures in this database required an unknown technique. Each required somebody with time to notice, decide and act.
Princeton was compromised. The difference was what happened in the next twenty-four hours.
The failure mode of leaving a grant in place is invisible. The failure mode of removing one is an outage with your name on it.
Removing seven participants from a population defined by willingness rather than skill leaves the population substantially intact.
Around 30% of 2025 breaches originated with a third party. The boundary an organisation defends stopped being the boundary that determines its exposure.
Where a market has one dominant platform, the distinction between a customer list and a national register largely disappears.
Trial volunteers consented explicitly and specifically. The consent given did not contemplate this.
Espionage-grade capability applied to straightforward theft, against a target with no reversal and no deterrent.
The redundancy people assume exists between channels frequently does not exist in the infrastructure.
Where fibre runs, which routes carry which customers, where the single points of failure sit — a dependency map for organisations that were never asked.
Three separately checkable claims in one sentence, against a corpus full of “certain information may have been accessed”.
Prevention will fail. Detection is what determines whether that becomes a state government offline for 28 days.
For a large company the regulator is not the most expensive consequence of a failure. The failure is.
The first case argues for stronger consent controls. The second shows they would not have helped, because nothing about the authorisation was wrong.
What was counted is not what matters, and what matters was not counted.
The fact travels immediately; the detail follows when it is reliable. It is the structure this desk asked for at 25-1027.
A region described as worst is exactly the claim that most needs the discount — insurers and procurement consume it.
For most of the interval the company was the victim of an incident that had already happened and had not yet surfaced.
Content tells you what a known person said. Metadata tells you who the people are — and it is the one that scales.
A 200-megabyte database can hold every customer a company has. The number is chosen because it sounds large.
An ecosystem-wide long tail alongside sector concentration. Both are true, and it complicates the corpus’s own argument.
The structural argument covers only the zero-day case. The corpus weakened itself by folding the two together.
A perimeter appliance is not a long-tail asset competing for attention. It is the front door.
Cities do not recover differently. They simply cannot stop describing it.
Neither actor wanted the vendor. Both wanted what the vendor holds about everyone else — the same reach as a thousand intrusions, from one operation.
Scarcity normally produces rising wages and employers training people up. “Cannot afford” and “cannot find” describe the same failed hire.
The claimant must prove a causal link that banks, regulators and the defendant cannot establish with far greater resources.
The reached system is almost never the one the security programme was built around.
There is no packet to inspect and no domain to block. The output of the call is a legitimate action by an authorised person.
No data involved, no system touched, no notification anywhere. The company simply could not trade.
A subsidiary carries the parent’s brand and data relationships, frequently with a fraction of its security capability.
Domains are replaced in days. Escrow is the mechanism that lets parties who would defraud each other trade at all.
A client reads that their bank has had a breach. The bank’s systems were not compromised. Both are true.
The corpus’s central complaint — harm that cannot be quantified is not compensated — has an exception here.
A manipulated model that can only write text produces wrong text. One that can move money produces an incident.
A university discovering redirected payroll has suffered an incident. An employee who was not paid has suffered a loss on a specific date.
The support function is where data is most accessible and least defended, because its purpose is to give people access to things.
A breach notification records an affected count. It does not record what proportion of affected parties took which mitigating action.
Forty people at one supplier is the number that describes what the £1.9 billion is made of.
Its own controls held in April. The data left in September through an estate it did not run.
No records exposed, no notification owed, nothing in any register. What happened is that people stopped being paid.
An intrusion at one company produced a sovereign commitment in four weeks. Banks too large to fail got capital requirements in exchange; there is no equivalent here.
Extortion works by finding who cannot refuse. This is the endpoint of that logic.
A regulator saying “this is ransomware, we don’t yet know by whom” on day two serves everybody better than a complete account on day thirty.
A social services outage means a benefit application does not progress for somebody who applied because they had nothing.
Stolen data eventually appears. Unavailable data is noticed immediately. Altered data continues to be used.
A company can raise prices. A county cannot — more security means visibly less of something a resident can see.
A firewall configuration describes the network behind it and carries the keys. Reconnaissance completed in advance, for every customer at once.
There is nothing else to say to an affected participant. That is the finding, not the criticism.
The cost went up and the cover went down. Every available explanation for that is uncomfortable.
Where a sector has four participants, two incidents approach population-scale coverage.
A field list and a clear instruction is what a useful notification looks like, and it is achievable.
The public record of an incident is generally two unverifiable assertions pointing in opposite directions.
Everyone scans repositories for committed secrets. Almost nobody scans the ticket system, which accumulates the same material indefinitely.
Sixty agencies at once means something common to all of them fell. Consolidation working as designed, failing all at once.
Five months quiet, ten days of theft. A single dwell-time figure conflates the two, and organisations optimise against the wrong phase.
Destroyed data announces itself. Fabricated data does not. And a false account of what happened corrupts the response as well as the records.
One paid and the data circulated. One refused and the data was published. The difference in outcome is the money.
A conviction is the highest-confidence attribution in this corpus — and it convicts a person, not a cluster, because the cluster is not an entity.
Twenty-six times smaller than a single ransom payment filed elsewhere in this database. Watching money you cannot seize is the ordinary condition.
Whatever the constraint was, it was not budget, headcount, expertise or tooling.
837 incidents, 419 confirmed breaches. The 418 that never became a disclosure are the sector’s real attack volume.
A corpus assembled from disclosures records failures in detail and successes almost never.
Internet-facing, parsing untrusted input, trusted by everything behind it. All three by design — and the customer has no hardening available.
The only action in this database that produces a certain answer to “are they still in?”
A state-linked group running ransomware collapses the distinction the corpus is organised around — and from a defender’s position it is unresolvable in the moment.
A state capital did not have the capacity to respond without help. For a city, the failure to invest was not a choice against an alternative.
An unsophisticated technique that works is not a lesser threat than a sophisticated one. It is a worse one.
The published “we don’t hit hospitals” rules were positioning. An operation whose affiliates pick the victims cannot implement a sector exclusion.
Self-hosting transfers the patch obligation. In a window measured in days, that transfer decides the outcome.
A sector whose failure would degrade the response to every other incident in this database.
Three brands, three jurisdictions, three timetables. The pattern exists only above the level anyone is obliged to report.
The largest incidents in this database are measured only as a byproduct of a commercial risk-transfer market.
By the final phase there was no peer sector to watch, because the target was defined by a product rather than an industry.
A safety regime, built for other purposes, produced the segmentation that a security argument has repeatedly failed to fund elsewhere.
An airline reading about Hawaiian on a Monday had, at most, a fortnight.
A caller claiming to be an agent locked out before a client meeting is making a request the function exists to grant, dozens of times a day.
Credit monitoring is a product designed for the population that files the most reports — and useless against a persuasive phone call about savings.
A financially motivated attacker must launder, must avoid attention, must be able to convert. An attacker who wants to cause damage has none of those constraints.
A retailer and a bank suffering identical intrusions produce very different invoices, and the difference is regulation rather than damage.
A notification arriving from an entity the recipient may not recognise as connected to the shop.
For most organisations, most of the time, the answer is a phishing email. The rest is what happens to those worth the effort.
A function nobody considers sensitive — buying things — accumulated the staff directories of nineteen client organisations.
The constraint was never analyst hours. It was people with standing to make a decision and time to follow it through.
Limited fields, no financial data, low risk — the standard reassurance. It does not hold when being on the list is the sensitive fact.
No control that checks sender authenticity helps, because the sender was authentic. What was false was the person operating it.
Between $2,600 and $5,700 per person, against a sector norm of twenty dollars of credit monitoring. The difference is not generosity.
An energy provider serving a population had an incident. The public record contains a group name and a month.
A three-day e-commerce shutdown was a decision, not a failure. The delayed earnings release is the mandatory signal breach law never produces.
A single business email compromise took $7.9 million. A continental operation recovered $3 million.
No credential stolen, no server compromised, no employee deceived. The contract executed exactly as published — the specification and the intent diverged.
A $28.7m demand generates a board meeting, a law firm, an insurer and eventually a public record. A $40,000 demand generates a wire transfer.
A group that works one industry at a time is reusing research, not expressing a preference. That makes the next target legible.
What $2.85 million bought was a recording, made by the counterparty, of an unverifiable claim. The second demand went to districts that had never paid.
Notifications usually describe a subset. Co-op did not have that sentence available — a loyalty scheme is built to be complete.
£206 million in revenue that never arrived. Groceries are perishable and demand is not deferred — the loss is permanent in a way a car maker’s is not.
A webshell is the least sophisticated technique in this database. That it worked against the system of record is the finding.
Disclosing an attempt reveals detection capability. Holding it is not a compliance failure — it is the point.
The corpus has been over-weighting the minority route, because a named CVE generates documentation and a stolen password does not.
Hospitals reorder against expected supply. A delay of weeks means deferred procedures nobody will ever connect to a supplier’s IT incident.
Per-capita recovery falls as the class grows. The largest incidents in this database have the weakest claim on the mechanism.
The email store is worth more than the institution is — and the exposed parties are people who simply wrote to an academic.
This database has 350 files and none of them cover a stolen phone — because it produces no notification and no defendant.
A control that is correct 999 times out of 1,000 teaches people to stop reading it. That is not user failure.
A floor from a public ledger and a ceiling from an interested party are not the same kind of object. This corpus has not always said which it was holding.
An operation that runs on rotas, subscriptions and payment disputes does not require exceptional people. That is what makes it reproducible.
Exaggeration implies the figure was a distorted measurement. This suggests it was not a measurement.
$1.447 billion in one theft — around 7% of a full year of all reported US cyber-fraud losses. A state revenue event, not a crime statistic.
The second move works because the first one is real. The employee has a genuine problem, and internal IT has arrived unprompted to solve it.
Success is the absence of an event, which is unobservable. Failure is a public incident with a named owner.
An organisation appears on the list because it did not pay, or paid late. An organisation absent from the list may have paid.
Internet-facing, authentication-heavy, holding the files too sensitive for email. Managed file transfer keeps producing portfolios of victims.
Sanctions work against organisations that need the financial system. A state intelligence service has no revenue to interdict.
The first instrument in this corpus that reaches the organisation the customer has never heard of — and it regulates availability, not just data.
The identity boundary expressed as hardware. And a vendor exploited recently is more likely, not less, to be exploited again.
Those confidentiality figures exist because a law requires them. No equivalent exists for a month of paper charting, because no law requires one.
The corpus does not record availability harm less because it matters less. It records it less because nothing compels anyone to measure it.
Benefits records identify people by their need for support, and 59% of the state was in them.
A stated plan costs nothing to announce and cannot be checked, and it raises pressure on the victim at no risk to the group.
Not the customer of a customer. The family of an employee of the breached company.
Two flaws individually rated manageable, combining into compromise with no interaction at all.
A slower process for tinned goods costs margin. A slower process for produce costs the produce.
An American software vendor’s outage changed what was on sale in British supermarkets.
Nokia was right that its systems were not breached. Its code was published anyway.
Eighty seconds is less time than it takes to read an alert. A defence that depends on somebody noticing has already lost.
The last four digits cannot buy anything. They are what the call centre asks for.
Invoice records describe who supplies whom, on what terms — useful to a competitor and to a fraudster.
A reader treating notification counts as a measure of exposure would be wrong by two orders of magnitude here — and cannot tell from outside which cases are like this one.
Once identity is compromised, a reset performed over the phone is exactly the mechanism it is trying to undo. The only remaining verifier is a face.
The case where the availability cost is documented and the confidentiality count is the footnote.
What was restrained was not the data. It was one person’s ability to look at it and describe what he found.
The rule requires disclosure of a material incident. It does not require the company to show its working — and Halliburton said so, in writing, to the SEC.
Presenting "encrypted" and "corrupted" as interchangeable makes an accident of the attacker’s process sound like a defence.
A file containing people who died twenty years ago is not a file that was being maintained. It is an accumulation, sold as current.
The regulator did not need an intrusion. The offence was the posture itself.
The mechanism scaled the damage and did not scale the repair. The fallback needed was people, and headcount is what the automation was bought to reduce.
Identical harm, no attacker, and the same absence of any obligation to measure what it cost.
Residency is not a customer relationship. There is no competitor to move to and no contract to renegotiate.
Applied for a job, was not hired, and handed over a social security number to be considered.
2.2 million against 45 million is not a disagreement about scope. One of them is wrong.
Nobody designs a chat workspace as a data store, and every organisation ends up with one.
A number is not a name until somebody looks it up, and looking it up is trivial. What the set contains is a contact graph.
Whatever does not survive a migration is removed silently, and nobody is told.
Customers learned their data had gone, and could not learn from whom.
One paid and the data circulated anyway. One refused and the data was published. The suppression half delivered in neither case.
It had the data, it could read the data, and it still named the wrong institution.
The standing objection to everything this database says about availability harm is that nobody can show it reaching a person. Here a trust did.
Those are not records lost. They are appointments that did not happen, to people who were already waiting.
165 separate failures with one shape, and a platform that was never itself breached.
A 560 million claim graded low sits below a 110 million disclosure graded high. That ordering is the point of having grades.
A rule to collect identity documents, and no matching rule to dispose of them.
A customer can change bank. An employee handed the details over as a condition of the job.
The fallback held for a month across 140 hospitals — because enough staff had worked that way before. That is a resource with a retirement date.
A member looking up a condition is not browsing. The page is what reveals the worry.
A victim negotiating with the brand is negotiating with the party that holds the least. The files sit with the affiliate.
Seven years of guests, most of whom stopped being customers long ago.
A restaurant chain without tills is not a degraded restaurant chain.
Data for sale reaches whoever pays. Data published free reaches everyone, permanently.
Someone who found work in 2006 had no route to ask for their record to be removed.
A company that pays quietly and says nothing has taken the cheaper path. The sample of known payments is not a sample of payments.
Item 1.05 does not ask whether a ransom was paid. So the largest extortion payment on record is compatible with a filing that never mentions one.
A written requirement that MFA be enabled everywhere is not a control. It is intent somebody then has to enforce against an estate nobody has fully inventoried.
No exploit and no zero-day. An account existed, it had a guessable password, and nobody had required a second factor on it.
The first flaw supplies the authentication the second one requires. A pair of medium problems is not a medium problem.
The pressure did not run through the hospital at all. It ran through the patients.
No lookalike domain and no spoofed sender. The message came from a real colleague’s real account.
The missing measurement is not lost revenue. It is warnings that did not reach people.
Diversion is the rare availability harm that produces a number — in minutes, measured by the ambulance service.
Containment converts an unbounded loss into a bounded one, and moves it onto whoever needed the service that week.
Someone who paid off their mortgage in 2016 had no account, no login, and full exposure.
Nobody is fined for being breached. People are fined for what they said beforehand.
It gained nothing by publishing the route, and published it anyway. That is the standard.
Espionage succeeds by producing no artefact. The ones in this corpus are the ones that failed at the last step.
Nobody attacked anything. A sharing mechanism offered a wider scope than the task needed.
A breach notification counts records. It has no field for a fortnight of manual check-in.
Paying bought silence about data already copied. None of the $15m was spent on the members.
Nobody decided to remove the isolation. It was lost while moving the servers.
The campaign is unmeasurable. Its individual victims are not.
An organisation dealing with an incident should not assume it is dealing with an incident.
The blast radius was tiny because the targeting was precise, not because the access was limited.
A token signed with a trusted key is not a forgery the platform can detect. It is a valid token.
The system with the weakest claim to protection held the widest population. Breadth is what a mail-merge store is for.
Thin harm spread across a very large number of uninvolved people is the kind nobody measures.
The fatal injury was to cash flow, and it took two years to prove fatal.
The federal files were a twentieth of the dump. The rest belonged to everyone else the supplier served.
Reset exists to let a user in without the credential. That makes it an alternative route to everything.
People write to support when something has gone wrong, and they explain it.
Nobody assessing a phone-system vendor thinks to ask about its staff’s trading software.
The unit that matters is not the facility. It is the number of organisations that stop when it does.
A signing key burned into shipped hardware cannot be rotated the way a credential can.
A password is a claim to be checked. A cookie is the receipt showing the check already happened.
Personal cloud storage is sold on one promise. For eleven days the product did not exist.
Code signing answers "did this come from the vendor". Here the answer was yes, and it was the wrong question.
A conversation title is a list of what somebody asked a machine in private.
The mechanism for reaching the company was part of the same incident.
The only instrument anyone had was a shopper noticing an absence.
The patch had existed for two years. The campaign needed no new capability, only servers nobody had looked at.
The distribution channel an organisation trusts most is the one that reaches everything.
Six weeks to notice, one day to fix. Time to fix is almost never the constraint.
The customer headline and the actual victim population were different groups.
No database at the centre of it. A national postal operator simply stopped being able to send a parcel abroad.
The stopgap became the destination. Hosted Exchange was retired rather than restored.
The answers were true before the employer collected them, and they stay true afterwards.
The fallback kept the state running, and put a month of government correspondence in consumer mailboxes.
A file list is aimed past the victim, at the customers who now have to ask.
Cloudflare was not saved by the metal. It was saved by origin binding — and this key was not doing that.
623,700 had data exposed. The people actually harmed were the ones whose procedure moved.
The second factor was not bypassed. It was delivered to the right person, who said yes.
The refusal was right. The people who paid for it were children who cannot freeze a credit file.
Two small NATO members, two months apart, two entirely different instruments.
Everything the company said in August was true. In December none of it helped.
Collected from a child, retained past the relationship, past the product, past recognition.
Ten bitcoin across a billion people is a fraction of a cent each. That is the market price.
An attempt that stops a carrier’s morning departures has succeeded at everything but encryption.
A remedy that fitted the harm and could not reach the party holding it.
Tax collection stopping is fiscal. Customs stopping means the containers do not move.
The security of a system is the security of everyone it has delegated to — a set nobody enumerates.
No exploit, no malware. Someone kept reading what they had been allowed to read.
Something noticed on day eleven. The judgement applied to it is what failed.
Inventory is waste, so nothing is spare. That is the method working, and it is why one supplier stopped everything.
Germany was not the target. The turbines were on the same satellite, and the wiper did not check.
A freight forwarder’s downtime is measured in other companies’ cargo.
Finding a ransom note starts a recovery conversation. That was the deliverable.