Ambulatory cardiac data is continuous, and continuous physiology is a behavioural record collected for a clinical reason.
Extortion refused, 234 GB published, 2.6 million addresses verified. The refusal produced a record that payment never does.
Deal documents are worth a fortune for days and nothing after. There is no ransom note, because publication destroys the value.
The case for paying depended on a repeat player with a reputation to protect. Seventy-three new entrants in a year removes exactly that.
A containment rate defined against encryption improves partly because encryption is becoming less common.
A shift from the transaction that sometimes works to the one this corpus has never seen work.
An operator optimising for revenue keeps negotiations separate. Branding them together does the reverse.
Automation, mining, peripherals, a newspaper. The vulnerability selected the victims, and the attacker learned afterwards who they were.
There is no version of “monitor your accounts” that helps somebody who has already taken the call.
Geopolitical exposure is additive, not substitutive. It does not displace ordinary criminal risk — it sits on top of it.
Nobody targeted a newsroom. A media organisation cannot scope its security to the systems that obviously hold journalism.
One ERP zero-day, 29 named victims across unrelated sectors, nothing encrypted. Theft-and-publication at industrial scale.
Extortion works by finding who cannot refuse. This is the endpoint of that logic.
What concentrated was not the data but the method. Every tenant presents the same consent screen and the same vocabulary for a caller to use.
The variable that predicts the outcome is not the payment decision. It is whether you could recover without them.
One paid and the data circulated. One refused and the data was published. The difference in outcome is the money.
A $28.7m demand generates a board meeting, a law firm, an insurer and eventually a public record. A $40,000 demand generates a wire transfer.
A leak-site count is a measure of publication, not of income. This is the first case where both can be looked at side by side.
What $2.85 million bought was a recording, made by the counterparty, of an unverifiable claim. The second demand went to districts that had never paid.
A floor from a public ledger and a ceiling from an interested party are not the same kind of object. This corpus has not always said which it was holding.
Response cost and extortion demand are different quantities. The phrase “the attack cost £4.5m” invites the error of treating them as one.
If the demand is a function of revenue, the volume figure attached to it is decoration — and the attacker had no incentive to count accurately.
A stated plan costs nothing to announce and cannot be checked, and it raises pressure on the victim at no risk to the group.
The party that could have prevented it spent $25m. The parties that could not spent forty times that.
One paid and the data circulated anyway. One refused and the data was published. The suppression half delivered in neither case.
A victim negotiating with the brand is negotiating with the party that holds the least. The files sit with the affiliate.
A company that pays quietly and says nothing has taken the cheaper path. The sample of known payments is not a sample of payments.
Item 1.05 does not ask whether a ransom was paid. So the largest extortion payment on record is compatible with a filing that never mentions one.
A dump is chosen for extortion value, not evidence. This one disclosed its own method.
The encryption step was always optional. Drop it and you keep the reputational leverage for a fraction of the work.
Voice phishing into identity providers, then leak-site extortion. Active since 2020.