The API served the request as it would any other. The credential came from a vendor’s environment, and the vendor is the one party nobody has named.
444 counts events. 133 counts things somebody assessed as saleable and put on the market.
30 unsecured datasets, ~16 billion records. The thefts were old; the index is what makes them usable — and the number is contested.
Password-protected and unencrypted, which is the whole file. The state found a hundred more laptops nobody was watching.
Voice phishing into identity providers, then leak-site extortion. Active since 2020.