Same code, same comments, four operators, one week. The fix was public in the source tree for a month before it reached the browser.
A private company placed monitoring code on machines it did not own, and published that it had.
One phishing email, nine months of movement, the whole warehouse. The sector’s reference breach, and the numbers in it do not expire.