The resilience of a nation’s communications, held as a private company’s operational decision.
No data taken, no notification owed, 70,000 people unable to pay a bill. Availability fails independently of confidentiality.
The redundancy people assume exists between channels frequently does not exist in the infrastructure.
A social services outage means a benefit application does not progress for somebody who applied because they had nothing.
The largest incidents in this database are measured only as a byproduct of a commercial risk-transfer market.
The first instrument in this corpus that reaches the organisation the customer has never heard of — and it regulates availability, not just data.
Those confidentiality figures exist because a law requires them. No equivalent exists for a month of paper charting, because no law requires one.
The corpus does not record availability harm less because it matters less. It records it less because nothing compels anyone to measure it.
Eighty seconds is less time than it takes to read an alert. A defence that depends on somebody noticing has already lost.
The case where the availability cost is documented and the confidentiality count is the footnote.
Identical harm, no attacker, and the same absence of any obligation to measure what it cost.
The standing objection to everything this database says about availability harm is that nobody can show it reaching a person. Here a trust did.
Those are not records lost. They are appointments that did not happen, to people who were already waiting.
The fallback held for a month across 140 hospitals — because enough staff had worked that way before. That is a resource with a retirement date.
A restaurant chain without tills is not a degraded restaurant chain.
Diversion is the rare availability harm that produces a number — in minutes, measured by the ambulance service.
Containment converts an unbounded loss into a bounded one, and moves it onto whoever needed the service that week.
It gained nothing by publishing the route, and published it anyway. That is the standard.
A breach notification counts records. It has no field for a fortnight of manual check-in.
Nobody decided to remove the isolation. It was lost while moving the servers.
Thin harm spread across a very large number of uninvolved people is the kind nobody measures.
The fatal injury was to cash flow, and it took two years to prove fatal.
The unit that matters is not the facility. It is the number of organisations that stop when it does.
Personal cloud storage is sold on one promise. For eleven days the product did not exist.
The mechanism for reaching the company was part of the same incident.
The only instrument anyone had was a shopper noticing an absence.
The customer headline and the actual victim population were different groups.
No database at the centre of it. A national postal operator simply stopped being able to send a parcel abroad.
The stopgap became the destination. Hosted Exchange was retired rather than restored.
623,700 had data exposed. The people actually harmed were the ones whose procedure moved.
An attempt that stops a carrier’s morning departures has succeeded at everything but encryption.
A freight forwarder’s downtime is measured in other companies’ cargo.