Automation, mining, peripherals, a newspaper. The vulnerability selected the victims, and the attacker learned afterwards who they were.
A subsidiary carries the parent’s brand and data relationships, frequently with a fraction of its security capability.
Nobody targeted a newsroom. A media organisation cannot scope its security to the systems that obviously hold journalism.
A university ERP holds staff, students, alumni donors and grant administration. One flaw reached all of it.
One ERP zero-day, 29 named victims across unrelated sectors, nothing encrypted. Theft-and-publication at industrial scale.