A claimed 630 GB from a contract manufacturer — mostly documents belonging to customers who were never attacked and may never be notified.
A claimed 2.2 million records. Long-lived brands hold data collected across decades, terms and regulatory regimes nobody has reconciled.
The group claimed 8 TB and named customers. Nothing beyond the claim is established, and we are not reprinting the customer list.
A global shutdown days after detection. From outside it reads as catastrophe; inside an incident it is often the correct call.
A nine-million-record claim against corporate IT, with device manufacturing reported untouched. The separation is the finding.
Generic manufacturing runs at high utilisation with no buffer stock. There is nothing in reserve when a plant stops.
A components maker warning of shipment delays. Qualification rules mean a medical supply chain cannot route around a supplier quickly.
Employees of a customer of a processor. Three steps from the incident, with no point at which they could have exercised judgement.
Three technology estates in one company. The research attention is on the vehicles; the billion-pound losses are in enterprise IT.
Plants on four continents stopped, most of them never attacked. Assessed at £1.9 billion — the UK’s costliest cyber incident.
Blocking more attempts and losing more data are the same finding. A manufacturer can lose its entire engineering position with no duty to tell anyone.
Corporate IT, a production line, and a connected product you can still reach after sale. Few industries carry all three.
For most of the interval the company was the victim of an incident that had already happened and had not yet surfaced.
A 200-megabyte database can hold every customer a company has. The number is chosen because it sounds large.
Automation, mining, peripherals, a newspaper. The vulnerability selected the victims, and the attacker learned afterwards who they were.
Manual operation is not a degraded mode at reduced throughput. The throughput is what the software provides.
Worse than any September through oil shocks, three-day weeks and a pandemic. Output statistics may be a better instrument than any breach register.
A stopped production system does not resume — it restarts from a different state. Nobody publishes the recovery curve.
Breach registers count individuals. Cost surveys estimate dollars. Nothing counts jobs.
A government buying physical parts it does not want, because a criminal group encrypted a third company’s systems.
A breach notification records an affected count. It does not record what proportion of affected parties took which mitigating action.
Forty people at one supplier is the number that describes what the £1.9 billion is made of.
Resilience is a wasting asset in cash as well as in process, and nobody tracks the financial half.
No records exposed, no notification owed, nothing in any register. What happened is that people stopped being paid.
An intrusion at one company produced a sovereign commitment in four weeks. Banks too large to fail got capital requirements in exchange; there is no equivalent here.
No affected-individual count anchors this file. A manufacturer could not manufacture for five weeks, and the metrics this industry collects barely register it.
Furnaces have physical states that are expensive to leave. Stopping cost real money before the attacker did anything — and they stopped on detection.
Hospitals reorder against expected supply. A delay of weeks means deferred procedures nobody will ever connect to a supplier’s IT incident.
Invoice records describe who supplies whom, on what terms — useful to a competitor and to a fraudster.
A dump is chosen for extortion value, not evidence. This one disclosed its own method.
One number was filed with a securities regulator. The other two were published by the people doing the extorting.
Every control answers "should this account reach this data". Here the answer was yes.
The $49m covers consultants and forensics. It does not cover the sales that never happened.
Reset exists to let a user in without the credential. That makes it an alternative route to everything.
Not a dwell time. Nobody was inside, because nobody needed to be.
A signing key burned into shipped hardware cannot be rotated the way a credential can.
The leverage is the victim’s preference that nobody find out. Disclosing removes it.
A file list is aimed past the victim, at the customers who now have to ask.
Not a system disabled. A system operated, into a state the plant was built to prevent.
The devices behave as specified. The specification assumed the network could be trusted.
Inventory is waste, so nothing is spare. That is the method working, and it is why one supplier stopped everything.