Two years between the intrusion and the notification, on identity documents. Small organisations produce long intervals, and mostly go unrecorded.
Three retailers, one crew, one window. The reusable asset is the shared supplier estate behind the brands.
The visible portion of workforce exposure is a sample of listed companies’ workforce exposure — a specific and wealthy subset.
Three brands, three jurisdictions, three timetables. The pattern exists only above the level anyone is obliged to report.
Disclosing an attempt reveals detection capability. Holding it is not a compliance failure — it is the point.
Response cost and extortion demand are different quantities. The phrase “the attack cost £4.5m” invites the error of treating them as one.
Not “nearly three million” — 2,947,264. Healthcare produces exact counts because every affected person must be notified.
The corpus does not record availability harm less because it matters less. It records it less because nothing compels anyone to measure it.
A dump is chosen for extortion value, not evidence. This one disclosed its own method.
A file list is aimed past the victim, at the customers who now have to ask.