The final count on the Conduent intrusion landed above 62 million people — third-largest in US healthcare history, at a processor most of them have never heard of.
The remedy is 24 months of monitoring. The scanned passport stays valid for ten years.
Legacy remote access at the entry point in 73% of intrusions, up from 38% in two years. The box keeps working, which is why it is still there.
Unpatched vulnerability, persistent tooling, deleted logs. The deletion is a finding in itself — nobody spends that effort on a boring record.
Two arrests at a laundering service. Intrusion capability is replaceable; banking relationships that move criminal proceeds are not.
No intrusion of its own — a dependency with a deadline, hitting the one week in the academic year with no slack in it.
Two years between the intrusion and the notification, on identity documents. Small organisations produce long intervals, and mostly go unrecorded.
A global shutdown days after detection. From outside it reads as catastrophe; inside an incident it is often the correct call.
A reported 15 million files from a publishing group. In a newsroom the sensitive material usually belongs to somebody who was promised anonymity.
No intrusion, no misconfiguration — a functioning business selling movement traces. From the traced person’s position the distinction is thin.
No attacker, no intrusion, and half a million lines public anyway. Registry publication is a one-way door.
A phone call to an outsourced service desk, a password reset, and £270–440 million across two retailers assessed as one event.
A three-month intrusion at the largest US public health system took biometric records among the 1.8 million affected. Credit monitoring does not cover a palm print.
Around three billion records in an unsecured database, including a billion KYC entries. No intrusion, no actor, and no way to say who read it.
Ten months in a diplomatic academy’s education platform, touching 360 serving diplomats. The coursework was never the point; the roster was.
Employees of a customer of a processor. Three steps from the incident, with no point at which they could have exercised judgement.
Plants on four continents stopped, most of them never attacked. Assessed at £1.9 billion — the UK’s costliest cyber incident.
Neither actor wanted the vendor. Both wanted what the vendor holds about everyone else — the same reach as a thousand intrusions, from one operation.
An intrusion at one company produced a sovereign commitment in four weeks. Banks too large to fail got capital requirements in exchange; there is no equivalent here.
Five months quiet, ten days of theft. A single dwell-time figure conflates the two, and organisations optimise against the wrong phase.
A corpus assembled from disclosures records failures in detail and successes almost never.
An unsophisticated technique that works is not a lesser threat than a sophisticated one. It is a worse one.
A retailer and a bank suffering identical intrusions produce very different invoices, and the difference is regulation rather than damage.
Personnel data decays. A network diagram does not — it converts the next intrusion from exploration into navigation, silently.
The employee did go looking for the official site. The search platform put something else first.
The employee was doing their job. The action was correct in every previous instance.
£206 million in revenue that never arrived. Groceries are perishable and demand is not deferred — the loss is permanent in a way a car maker’s is not.
A number that moves faster than the world does is measuring the instrument.
The regulator did not need an intrusion. The offence was the posture itself.
The partnership had ended the year before the intrusion. The records had not.
It did not grow because the intrusion grew. It grew because working out whose records sit in four terabytes takes eleven months.
A hundred and forty hospitals losing their record system is not a proportionate consequence of one download. What sits between is everything it was allowed to reach.
Six days between patch and intrusion. Faster than most manage, and longer than the window now exists.
The people who asked to be left off the public register were in the breach anyway.
An organisation dealing with an incident should not assume it is dealing with an incident.
Every remedy this database records requires a living person to take an action.
Personal cloud storage is sold on one promise. For eleven days the product did not exist.
The count is exact to the person. The explanation is a two-day window and nothing else.
"Sophisticated" describes the attacker’s resources. It says nothing about the size of the gap.