Holiday timing is not a coincidence. And a resident who needs a permit has exactly one place to get it.
A crash report exists because someone was in a collision. No vulnerability was exploited — a valid account did a permitted thing 300,000 times.
No zero-day, no custom tooling, no organisation. One person in their late teens and a credential without MFA.
The corpus has been over-weighting the minority route, because a named CVE generates documentation and a stolen password does not.
A support portal is a production system. 18,000 schools did not make 18,000 bad decisions — but the security did not scale with the concentration.