No intrusion, no misconfiguration — a functioning business selling movement traces. From the traced person’s position the distinction is thin.
No broker stores “attended a clinic”. It stores a coordinate, and the sensitive fact comes from a public map.
229,200 driver’s licences at a lending platform, plus data for 797 broker firms. The licence is the KYC document other institutions trust.
Espionage acquires data covertly at cost and risk. The same categories are purchasable, leaving no incident for anyone to file.
No account to close, no relationship to end, and a notification that cannot practically reach you. The exposure is real for being invisible.
Where the relationship never existed, the notification is the first contact and the bankruptcy is the last.
A reader treating notification counts as a measure of exposure would be wrong by two orders of magnitude here — and cannot tell from outside which cases are like this one.
A file containing people who died twenty years ago is not a file that was being maintained. It is an accumulation, sold as current.
A figure roughly nine times the population of the country it was attributed to, reported without the arithmetic being done.