More than 600 organisations across 80 countries since 2019, including US carriers and the lawful-intercept systems they run. The metadata was always the point.
The vulnerability was not a defect in the implementation. It was the specification — and the thirty-year exceptional-access debate now has an empirical entry.