Adopting ML-KEM cost the attacker one library. It costs a defence contractor its entire estate.
Revenue-cycle software for thousands of hospitals. Billing data is clinical data wearing an accounting costume.
BEC was already the costliest category using plain text and patience. Synthesis removed the last verification step people actually used.
The algorithms are free. The $15 billion is discovery, hardware replacement and re-certification — and small institutions will not be paying it.
The contract moves the work, the staffing and the cost. It does not move the consequence of resetting the wrong person’s credential.
A phone call to an outsourced service desk, a password reset, and £270–440 million across two retailers assessed as one event.
$900,000 a day against demands in the low millions. Printing those two numbers together constructs the attacker’s argument for them.
Espionage acquires data covertly at cost and risk. The same categories are purchasable, leaving no incident for anyone to file.
Two cities, two attacks, dispatch survived both. The cost is annual and questioned; the benefit is a disaster that cannot be evidenced.
Plants on four continents stopped, most of them never attacked. Assessed at £1.9 billion — the UK’s costliest cyber incident.
The only reliable incident costs in this corpus come from organisations that had no choice but to publish them.
One of very few files here where the corpus can see both halves of the cost — the records and the stoppage.
Self-service is not a convenience feature with a security cost. It is a decision about who holds authority.
Breach registers count individuals. Cost surveys estimate dollars. Nothing counts jobs.
The cost went up and the cover went down. Every available explanation for that is uncomfortable.
Recruiting an insider costs money, time and exposure to prosecution. Persuading an agent costs a paragraph and works every time.
Furnaces have physical states that are expensive to leave. Stopping cost real money before the attacker did anything — and they stopped on detection.
Avoided-loss reasoning is unfalsifiable. A differential compares what actually happened to two groups — in the currency budgets are written in.
Response cost and extortion demand are different quantities. The phrase “the attack cost £4.5m” invites the error of treating them as one.
A stated plan costs nothing to announce and cannot be checked, and it raises pressure on the victim at no risk to the group.
A slower process for tinned goods costs margin. A slower process for produce costs the produce.
A wrong assurance cost nothing. A correct correction cost a lawsuit and months under an order.
The case where the availability cost is documented and the confidentiality count is the footnote.
Liability caps sever the connection between the cost of a defect and the party positioned to prevent it.
Identical harm, no attacker, and the same absence of any obligation to measure what it cost.
The practical entitlement reads: you will be told, unless telling you costs more than the organisation has left.
A breach notification counts records. It has no field for a fortnight of manual check-in.
The $49m covers consultants and forensics. It does not cover the sales that never happened.
Costly to the refuser, costless to everyone else. The only one in the database like that.