Handed to a doorman, kept by a vendor, sold by the hundred thousand a day. A licence number can be reissued; the scan cannot.
Two hospitals, two weeks on paper, ambulances turned away, and no group claiming it. If no data left, there will be no record of any of this.
One fulfilment provider, disclosed brand by brand over weeks. Some customers found out when the parcel did not come.
Two years between the intrusion and the notification, on identity documents. Small organisations produce long intervals, and mostly go unrecorded.
Three retailers, one crew, one window. The reusable asset is the shared supplier estate behind the brands.
The visible portion of workforce exposure is a sample of listed companies’ workforce exposure — a specific and wealthy subset.
Three brands, three jurisdictions, three timetables. The pattern exists only above the level anyone is obliged to report.
Disclosing an attempt reveals detection capability. Holding it is not a compliance failure — it is the point.
Response cost and extortion demand are different quantities. The phrase “the attack cost £4.5m” invites the error of treating them as one.
Not “nearly three million” — 2,947,264. Healthcare produces exact counts because every affected person must be notified.
The corpus does not record availability harm less because it matters less. It records it less because nothing compels anyone to measure it.
No evidence, then 36,000, then 2.5 million. Three accurate statements about one intrusion, and the operator was gone before the last one.
A dump is chosen for extortion value, not evidence. This one disclosed its own method.
A file list is aimed past the victim, at the customers who now have to ask.
Not ransomware, the broker said. Fourteen months of access at various times, Social Security numbers taken, and no account of how.
A two-day filing, a four-month intrusion, a nine-month wait for the notice. The broker never published a count; the class ran to 3.5 million.