Up to six million customers exposed in 2025; records published in 2026. Notification law assumes an incident that ends.
A name concatenated from three crews. Attribution language implies a roster, and a coalition brand quietly breaks that implication.
A stopped production system does not resume — it restarts from a different state. Nobody publishes the recovery curve.
Breach registers count individuals. Cost surveys estimate dollars. Nothing counts jobs.
Forty people at one supplier is the number that describes what the £1.9 billion is made of.
Resilience is a wasting asset in cash as well as in process, and nobody tracks the financial half.
No records exposed, no notification owed, nothing in any register. What happened is that people stopped being paid.
An intrusion at one company produced a sovereign commitment in four weeks. Banks too large to fail got capital requirements in exchange; there is no equivalent here.
The average operation is getting weaker and the worst one is getting stronger. The aggregate statistics cannot show it.
No affected-individual count anchors this file. A manufacturer could not manufacture for five weeks, and the metrics this industry collects barely register it.
The second factor was not bypassed. It was delivered to the right person, who said yes.
"Sophisticated" describes the attacker’s resources. It says nothing about the size of the gap.
The encryption step was always optional. Drop it and you keep the reputational leverage for a fraction of the work.
The alert fired on day one. The customers heard on day sixty-one, from the attackers.