Abbott confirmed unauthorised access to a limited number of systems. ShinyHunters claims thirty million rows. Almost everything in between is unestablished.
A claimed 2.2 million records. Long-lived brands hold data collected across decades, terms and regulatory regimes nobody has reconciled.
The first case argues for stronger consent controls. The second shows they would not have helped, because nothing about the authorisation was wrong.
Every control answers "should this account reach this data". Here the answer was yes.
Nine weeks of bulk exports by email, logged and unread. Detection came from a dark-web listing, and the fine came under a law already replaced.