Sixteen months with valid logins, used to poach customers. Those who phoned to check the notice were told it was spam.
Valid logins, queried at scale, from a register no taxpayer can leave. The forum listing preceded the state’s confirmation.
Holiday timing is not a coincidence. And a resident who needs a permit has exactly one place to get it.
A crash report exists because someone was in a collision. No vulnerability was exploited — a valid account did a permitted thing 300,000 times.
No zero-day, no custom tooling, no organisation. One person in their late teens and a credential without MFA.
The corpus has been over-weighting the minority route, because a named CVE generates documentation and a stolen password does not.
A support portal is a production system. 18,000 schools did not make 18,000 bad decisions — but the security did not scale with the concentration.