19 million patients, 12,000 clinics, 2.5 terabytes — and a government that will not call it an attack.
Encrypted five days before a change of government, a day after the national CERT warned about ransomware.
76% of the year’s crypto theft value attributed to one state. On a public ledger, attribution is tractable in a way network telemetry never is.
The calculation is not that a city has money. It is that a city has visible pain and a decision-maker accountable to the people feeling it.
A number identifies a billing relationship. It now secures banking and government access, and the depending services cannot see a port request.
In many countries these are the most complete identity datasets in existence, and the state’s dataset is not one you can leave.
Formal documents are the version a government is prepared to publish. Email is where the decision was actually made.
Prevention will fail. Detection is what determines whether that becomes a state government offline for 28 days.
A government buying physical parts it does not want, because a criminal group encrypted a third company’s systems.
An intrusion at one company produced a sovereign commitment in four weeks. Banks too large to fail got capital requirements in exchange; there is no equivalent here.
A company can raise prices. A county cannot — more security means visibly less of something a resident can see.
A state-linked group running ransomware collapses the distinction the corpus is organised around — and from a defender’s position it is unresolvable in the moment.
Benefits records identify people by their need for support, and 59% of the state was in them.
Advice to change your own behaviour is what a defender issues when it cannot change the thing that is broken.
Three teams building parallel access rather than contesting it. An operation planning to survive being found.
A resident who needs to pay a water bill has one counterparty and no alternative.
Someone who found work in 2006 had no route to ask for their record to be removed.
Espionage succeeds by producing no artefact. The ones in this corpus are the ones that failed at the last step.
No intruder, no exploit. A statutory duty answered, and a tab nobody checked.
The people who asked to be left off the public register were in the breach anyway.
A decision made years earlier for classification reasons turned out to be the security control.
A token signed with a trusted key is not a forgery the platform can detect. It is a valid token.
The federal files were a twentieth of the dump. The rest belonged to everyone else the supplier served.
A population the holder cannot notify without defeating the reason it holds the data.
The fallback kept the state running, and put a month of government correspondence in consumer mailboxes.
Two small NATO members, two months apart, two entirely different instruments.
States reaching past the security apparatus, because the instrument built for this does not exist.
Ten bitcoin across a billion people is a fraction of a cent each. That is the market price.
Tax collection stopping is fiscal. Customs stopping means the containers do not move.
Finding a ransom note starts a recovery conversation. That was the deliverable.