Ambulatory cardiac data is continuous, and continuous physiology is a behavioural record collected for a clinical reason.
Extortion refused, 234 GB published, 2.6 million addresses verified. The refusal produced a record that payment never does.
A shift from the transaction that sometimes works to the one this corpus has never seen work.
There is no version of “monitor your accounts” that helps somebody who has already taken the call.
What concentrated was not the data but the method. Every tenant presents the same consent screen and the same vocabulary for a caller to use.
One paid and the data circulated. One refused and the data was published. The difference in outcome is the money.
What $2.85 million bought was a recording, made by the counterparty, of an unverifiable claim. The second demand went to districts that had never paid.
If the demand is a function of revenue, the volume figure attached to it is decoration — and the attacker had no incentive to count accurately.
A stated plan costs nothing to announce and cannot be checked, and it raises pressure on the victim at no risk to the group.
One paid and the data circulated anyway. One refused and the data was published. The suppression half delivered in neither case.
A victim negotiating with the brand is negotiating with the party that holds the least. The files sit with the affiliate.
Voice phishing into identity providers, then leak-site extortion. Active since 2020.