The form looked the number up and displayed it, so you were in the breach the moment someone typed your name. Fourteen years after the first file of its kind.
Nine million faces, indexed for matching, readable by anyone with the URL. Nobody in the store was ever a customer.
24 billion credential records from 36 sources in one indexed store. The thefts were old; the index is what makes them usable.
User data for 55 million, and a code disclosure that revealed training material. Two exposures, two sets of interested parties.
Minors’ records, federated universities, thin staffing and heavy vendor dependence. Exposure and capacity moving in opposite directions.
Around three billion records in an unsecured database, including a billion KYC entries. No intrusion, no actor, and no way to say who read it.
Detected and remediated in about nine hours, with exposure limited to names and numbers. Fast containment is a decision, not luck.
No account to close, no relationship to end, and a notification that cannot practically reach you. The exposure is real for being invisible.
The sector with the slowest patch cycle accumulates the most exposure. That needs no prediction about attacker capability.
The proposition that exposure produces harm is almost certainly true and is not demonstrated. Saying so is the difference between reporting and advocacy.
Around 30% of 2025 breaches originated with a third party. The boundary an organisation defends stopped being the boundary that determines its exposure.
Geopolitical exposure is additive, not substitutive. It does not displace ordinary criminal risk — it sits on top of it.
One episode of care generates records in six organisations — six independent breach exposures for the same history.
The visible portion of workforce exposure is a sample of listed companies’ workforce exposure — a specific and wealthy subset.
A CRO holds unpublished, market-moving results for competing sponsors simultaneously, and no register would record their exposure.
Recruiting an insider costs money, time and exposure to prosecution. Persuading an agent costs a paragraph and works every time.
Where disclosure is not mandatory, criminal forums become the primary public record — and affected people learn from researchers.
30 unsecured datasets, ~16 billion records. The thefts were old; the index is what makes them usable — and the number is contested.
An insurer knows every provider seen and every prescription filled. A more complete history than any clinician holds.
A privately held operator using the same product would have had the same exposure and, quite possibly, produced no public record at all.
A small municipal utility has the operational exposure of critical infrastructure and the budget of a town department — and no route into the record.
A reader treating notification counts as a measure of exposure would be wrong by two orders of magnitude here — and cannot tell from outside which cases are like this one.
Someone who paid off their mortgage in 2016 had no account, no login, and full exposure.
Nobody attacked anything. A sharing mechanism offered a wider scope than the task needed.
Not a dwell time. Nobody was inside, because nobody needed to be.
1,900 is the exposure. Three is the objective. No notification scheme has a field for that.
Six days, 2.76 million license numbers, and a mechanism the company will not confirm. Two plaintiffs could prove where the data went.
Type a name and address, get back the license number. At 25,000 queries a day, the quote form was the pandemic fraud’s best supplier.
Five years open, flagged by its own testers, closed by a reporter. The largest document exposure on record drew under $1.5 million in penalties.
No intrusion, no database, no attacker. An envelope window told 11,875 households something that cannot be taken back.
An upgrade broke the login, a consumer reported it twice, and applicants heard nothing for three months. Two regulators penalised two different failures.