The form looked the number up and displayed it, so you were in the breach the moment someone typed your name. Fourteen years after the first file of its kind.
6.9 million driver’s licence numbers, a field that is neither ceremonially protected nor practically replaceable.
A containment shutdown that locked members out of retirement accounts, and a credit union suing its own provider over the standards it contracted for.
Most of 1.4 million customers, advisers and employees. A CRM accumulates every population an organisation tracks, and so does its blast radius.
The exempted system is the one attackers find and the one that voids the policy. The exemption register is now a financial document.
Jurisdictions are penalised in insurance and procurement for the act of becoming transparent.
There is no packet to inspect and no domain to block. The output of the call is a legitimate action by an authorised person.
Reachable, taken, and published are three populations. Almost every affected count in this database is one of them without saying which.
The largest incidents in this database are measured only as a byproduct of a commercial risk-transfer market.
A caller claiming to be an agent locked out before a client meeting is making a request the function exists to grant, dozens of times a day.
The reporting duty tracks the sensitivity of the record. The security expectation tracks the sector of the company.
A service desk supporting agents and brokers is supporting people it does not know by sight.
The peer-warning argument only helps organisations that are not first. Hindsight makes May look like August.
An insurer knows every provider seen and every prescription filled. A more complete history than any clinician holds.
An open API at 25,000 queries a day and an agent portal with a password and nothing else. The first time a regulator priced the quote form.
Underwriting a life policy means knowing who someone is and what is wrong with them.
The threat was not publication but the share price. The company refused, confirmed 5,000, and told 850,000 more it could not rule them out.
Authentic data does not authenticate the story told about it. The records check out while the account does not.
A leak site is a shop window. A chat bot is a vending machine — no negotiation, no gatekeeper, just look somebody up.
No evidence, then 36,000, then 2.5 million. Three accurate statements about one intrusion, and the operator was gone before the last one.
One administrator, a page of carrier names, six million people who had never heard of it. The count took seven months and the settlement is under $3 each.
No antivirus since April, a refused $300,000 demand, and a count that went from zero to 42 million over nine months.
Two insurers, one week, one kind of contractor, and 2.08 million customers. Neither company named the vendor or confirmed it was shared.
The first war-exclusion case filed, and the one that never got a ruling. The market took its answer from Merck and rewrote the clause.
MFA existed, on the firewall. The application said privileged access. The policy was unwound from the first day, a month after the ransomware.
The war clause failed in court, so the market wrote a new one with attribution built in. Nobody has yet said who decides.
Six days, 2.76 million license numbers, and a mechanism the company will not confirm. Two plaintiffs could prove where the data went.
Not ransomware, the broker said. Fourteen months of access at various times, Social Security numbers taken, and no account of how.
No insurance, no reserve fund, no protocol mechanism. The guarantee was a company deciding to pay.
An exclusion written for armies, applied to a software update. Two courts said no, and the market rewrote the clause rather than argue again.
Confirmed: an attack in four markets and access at one Thai processor. Claimed: 3 terabytes of medical data. The two never met.
The first carrier to say it would not reimburse the ransom, in one country, for new policies. Nobody else followed.
Type a name and address, get back the license number. At 25,000 queries a day, the quote form was the pandemic fraud’s best supplier.
A seller of cyber insurance, encrypted, and a reported $40 million payment the company has never confirmed. Its own policy did not cover it.
A guidance document with no penalty attached. It put the insurer, the negotiator and the forensics firm on the hook for where the money went.
A two-day filing, a four-month intrusion, a nine-month wait for the notice. The broker never published a count; the class ran to 3.5 million.
Five years open, flagged by its own testers, closed by a reporter. The largest document exposure on record drew under $1.5 million in penalties.
No intrusion, no database, no attacker. An envelope window told 11,875 households something that cannot be taken back.
Nine weeks of bulk exports by email, logged and unread. Detection came from a dark-web listing, and the fine came under a law already replaced.
Seventeen months of access, found by a review ordered after competitors were hit. The class action paid the lawyers and nobody else.
An 11-month foothold found only because Anthem made the news. The case it produced decides who can sue after every breach since.
Ten months inside, found the week Anthem was found, disclosed 47 days later. Bank accounts and diagnoses left with the Social Security numbers.
One phishing email, nine months of movement, the whole warehouse. The sector’s reference breach, and the numbers in it do not expire.
Password-protected and unencrypted, which is the whole file. The state found a hundred more laptops nobody was watching.
A three-year-old patch, a quote form that kept everything, and 1.27 million people, most of whom had never bought a policy.
Nine drives went missing in a contractor’s data centre. Six were never found, and the record never established whether anyone took them.
An upgrade broke the login, a consumer reported it twice, and applicants heard nothing for three months. Two regulators penalised two different failures.
A million recorded calls, each one a member reading out their own Social Security number. The first penalty under the new notification law.