A private network is still a network. Once anything inside it could reach anything else, the isolation was a route.
Customer data leaked at a retailer serving 4.8 million. That figure is the customer base, not the affected count — and the distinction keeps getting lost.
Almost everything in this database stops at the IT boundary. Industrial-device compromise produces consequences that cannot be restored from backup.
A corpus assembled from disclosures records failures in detail and successes almost never.
A state-linked group running ransomware collapses the distinction the corpus is organised around — and from a defender’s position it is unresolvable in the moment.
No control that checks sender authenticity helps, because the sender was authentic. What was false was the person operating it.
An energy provider serving a population had an incident. The public record contains a group name and a month.
The rule requires disclosure of a material incident. It does not require the company to show its working — and Halliburton said so, in writing, to the SEC.
The regulator did not need an intrusion. The offence was the posture itself.
Thin harm spread across a very large number of uninvolved people is the kind nobody measures.