A month between attack and claim. Leak-site listings record negotiation failures, not attacks — and that biases everyone’s data.
Removing the largest operator did not reduce the market. It redistributed it into smaller, less trackable operations.
Somebody looked at the population of people who wanted to run ransomware, decided it was larger than the population who could, and built a product for the difference.
A $28.7m demand generates a board meeting, a law firm, an insurer and eventually a public record. A $40,000 demand generates a wire transfer.
An affiliate panel records who was attacked because the operation needed to track it. No notification law stands between the event and the row.
A leak-site count is a measure of publication, not of income. This is the first case where both can be looked at side by side.
A headline built on 62,400 of anything would be describing a quantity of database rows.
A chat archive is people talking. A panel dump is records — generated by the operation for its own use rather than asserted to anyone.
The partnership had ended the year before the intrusion. The records had not.
The usual version is a supplier the affected person has never heard of. Here it is a bank they were arguably banking with without knowing.
It had the data, it could read the data, and it still named the wrong institution.
A dump is chosen for extortion value, not evidence. This one disclosed its own method.
Settlement data proposed by USB stick, between two of the largest financial institutions on earth.
A stolen session token arrives after authentication. Multi-factor is not bypassed — it is never consulted.
High privilege, low attention, reachable. The vulnerable thing is rarely the one anyone would name.
No database at the centre of it. A national postal operator simply stopped being able to send a parcel abroad.
Pharma is permitted. Dentists are permitted. The line falls where a death could be attributed.
A file list is aimed past the victim, at the customers who now have to ask.