24 billion credential records from 36 sources in one indexed store. The thefts were old; the index is what makes them usable.
No intrusion, no misconfiguration — a functioning business selling movement traces. From the traced person’s position the distinction is thin.
600,000 claimed, 185,300 verified — and a franchise structure where the brand, the data holder and the notifier are three parties.
13.5 million accounts reachable because the environment was configured to permit it. Nobody had to be clever.
Hundreds of organisations claimed through public portals working exactly as configured. The guest user profile is a permission set nobody designed.
30 unsecured datasets, ~16 billion records. The thefts were old; the index is what makes them usable — and the number is contested.
Nobody attacked anything. A sharing mechanism offered a wider scope than the task needed.
Not a dwell time. Nobody was inside, because nobody needed to be.