24 billion credential records from 36 sources in one indexed store. The thefts were old; the index is what makes them usable.
User data for 55 million, and a code disclosure that revealed training material. Two exposures, two sets of interested parties.
Minors’ records, federated universities, thin staffing and heavy vendor dependence. Exposure and capacity moving in opposite directions.
Around three billion records in an unsecured database, including a billion KYC entries. No intrusion, no actor, and no way to say who read it.
Detected and remediated in about nine hours, with exposure limited to names and numbers. Fast containment is a decision, not luck.
No account to close, no relationship to end, and a notification that cannot practically reach you. The exposure is real for being invisible.
The sector with the slowest patch cycle accumulates the most exposure. That needs no prediction about attacker capability.
The proposition that exposure produces harm is almost certainly true and is not demonstrated. Saying so is the difference between reporting and advocacy.
Around 30% of 2025 breaches originated with a third party. The boundary an organisation defends stopped being the boundary that determines its exposure.
Geopolitical exposure is additive, not substitutive. It does not displace ordinary criminal risk — it sits on top of it.
One episode of care generates records in six organisations — six independent breach exposures for the same history.
The visible portion of workforce exposure is a sample of listed companies’ workforce exposure — a specific and wealthy subset.
A CRO holds unpublished, market-moving results for competing sponsors simultaneously, and no register would record their exposure.
Recruiting an insider costs money, time and exposure to prosecution. Persuading an agent costs a paragraph and works every time.
Where disclosure is not mandatory, criminal forums become the primary public record — and affected people learn from researchers.
30 unsecured datasets, ~16 billion records. The thefts were old; the index is what makes them usable — and the number is contested.
A privately held operator using the same product would have had the same exposure and, quite possibly, produced no public record at all.
A small municipal utility has the operational exposure of critical infrastructure and the budget of a town department — and no route into the record.
A reader treating notification counts as a measure of exposure would be wrong by two orders of magnitude here — and cannot tell from outside which cases are like this one.
Someone who paid off their mortgage in 2016 had no account, no login, and full exposure.
Nobody attacked anything. A sharing mechanism offered a wider scope than the task needed.
Not a dwell time. Nobody was inside, because nobody needed to be.
1,900 is the exposure. Three is the objective. No notification scheme has a field for that.