A dispute about volume is a dispute about the wrong axis. Ask instead which fields can be reissued.
76% of the year’s crypto theft value attributed to one state. On a public ledger, attribution is tractable in a way network telemetry never is.
A compromise at a third-party ticketing platform used by EY’s IT staff. Ticket attachments hold whatever was needed to reproduce the problem.
BEC was already the costliest category using plain text and patience. Synthesis removed the last verification step people actually used.
Two arrests at a laundering service. Intrusion capability is replaceable; banking relationships that move criminal proceeds are not.
Payments down 44%, claims up 40%. An ecosystem earning less per victim has an obvious incentive to increase volume.
Deal documents are worth a fortune for days and nothing after. There is no ransom note, because publication destroys the value.
Ransomware is 28% of claims and 52% of the money. BEC is the most frequent and among the cheapest. They need separate budgets.
AI-referencing complaints are ~4% of reported losses. The other 96% is the story — and the AI share is undercounted by construction.
Privilege stops a court compelling disclosure. It says nothing about an intruder copying the file, and the gap is filled by IT controls.
The unwritten backstop was that someone would ring the executive and recognise them. The seniority that makes impersonation work is what makes the voice public.
A reported $292 million protocol exploit. No credential, no dwell time, no log — and no ability to disconnect while you investigate.
The exempted system is the one attackers find and the one that voids the policy. The exemption register is now a financial document.
Four business days from a materiality determination the company itself makes. The clock and the investigation run on incompatible timescales.
Strong authentication on the firm’s staff, optional for the client’s. The obstacle is that the person who would insist is also selling to them.
39% breached, most exposing client data. Firms hold the material clients assembled precisely because it was too sensitive to handle alone.
No anomalous login, no unusual volume, no malformed input — just a grammatical question, for three weeks.
229,200 driver’s licences at a lending platform, plus data for 797 broker firms. The licence is the KYC document other institutions trust.
967,000 accounts at a lending platform. Underwriting assembles identity, income and obligations — including for people who were declined.
Aggregate premium fell while individual quotes rose 15–20%. The correction lands hardest on those least able to fund controls.
Around three billion records in an unsecured database, including a billion KYC entries. No intrusion, no actor, and no way to say who read it.
Authentication, authorisation and monitoring all worked. The difference between a legitimate lookup and this one is intent, and intent is not a field.
A six-month window on a small-business lending product, in one of the most heavily monitored environments in commercial technology.
Sixty institutions down through one provider. Pooling technology is what lets small member-owned banks exist, and it concentrates the risk.
Every sector that survived an outage this year did it on a manual fallback inherited from an earlier era. Digital-only removed it on purpose.
20,000 people unable to reach their money, with no branch to visit and frequently no second account.
A commercial claimant holds the contract, can quantify the loss and can fund discovery — which is where security practice actually gets examined.
The signature schemes held. The hash functions held. The losses came from signing workflows and outsourced support.
Espionage-grade capability applied to straightforward theft, against a target with no reversal and no deterrent.
The mechanism works. Its scope is defined by the wrong boundary — these incidents are not sector-shaped.
Notification law exists to protect people who cannot protect themselves, and JPMorgan Chase is not that.
Vendor assessment at its most rigorous did not prevent this. The instrument measures whether a framework exists, not whether it operates.
An operator optimising for revenue keeps negotiations separate. Branding them together does the reverse.
You can discover who your competitors bank with more readily than who runs their servers.
A credit application is the densest identity document an ordinary person produces. Most of the people in the database were declined.
Nobody broke the rules. The rules have no term for the gap between a vendor knowing and a controller knowing, so two compliant clocks can sum to anything.
Its precision is an artefact of counting, not evidence of accuracy. The buried sentence is the reliable part.
A client reads that their bank has had a breach. The bank’s systems were not compromised. Both are true.
A university ERP holds staff, students, alumni donors and grant administration. One flaw reached all of it.
Seventy-four independent due-diligence processes, all compliant, none of which established whether the vendor patched its own front door.
Payments become known; refusals do not. The observable signal is biased towards paying, and it is the observable signal that sets expectations.
The bureau’s customers are lenders. The people in the database are its product.
The sector best measured in one jurisdiction is thinly recorded in another — a statement about supervisory publication, not about the banks.
A financially motivated attacker must launder, must avoid attention, must be able to convert. An attacker who wants to cause damage has none of those constraints.
A retailer and a bank suffering identical intrusions produce very different invoices, and the difference is regulation rather than damage.
A function nobody considers sensitive — buying things — accumulated the staff directories of nineteen client organisations.
Between $2,600 and $5,700 per person, against a sector norm of twenty dollars of credit monitoring. The difference is not generosity.
No credential stolen, no server compromised, no employee deceived. The contract executed exactly as published — the specification and the intent diverged.
No vulnerability. Authorised employees performing lookups they were entitled to perform. The security model was not defeated — it was rented.
The closest thing in this database to a measured downstream consequence — and it still is not the proof.
$1.447 billion in one theft — around 7% of a full year of all reported US cyber-fraud losses. A state revenue event, not a crime statistic.
Internet-facing, authentication-heavy, holding the files too sensitive for email. Managed file transfer keeps producing portfolios of victims.
The first instrument in this corpus that reaches the organisation the customer has never heard of — and it regulates availability, not just data.
Support systems accumulate whatever customers attach to tickets. Nobody plans for that.
The partnership had ended the year before the intrusion. The records had not.
The usual version is a supplier the affected person has never heard of. Here it is a bank they were arguably banking with without knowing.
It had the data, it could read the data, and it still named the wrong institution.
A customer can change bank. An employee handed the details over as a condition of the job.
Containment converts an unbounded loss into a bounded one, and moves it onto whoever needed the service that week.
Settlement data proposed by USB stick, between two of the largest financial institutions on earth.
Someone who paid off their mortgage in 2016 had no account, no login, and full exposure.
A reader comparing incidents by their first published figure is comparing almost nothing.
The working exploit was published by its own execution, in a block anyone could read.
The count is exact to the person. The explanation is a two-day window and nothing else.
A voter who wrecks the protocol wrecks their own holding — unless the holding lasts one transaction.
A quorum counts signatures. Security depends on the independence behind them, and code enforces only one.
No insurance, no reserve fund, no protocol mechanism. The guarantee was a company deciding to pay.
A control the server can be persuaded to skip is not a second factor. It is a convention.