Encrypted five days before a change of government, a day after the national CERT warned about ransomware.
Customer data leaked at a retailer serving 4.8 million. That figure is the customer base, not the affected count — and the distinction keeps getting lost.
Post-incident guidance that leads with the exposed device rather than the adversary. For a utility with one engineer, that is the usable document.
New guidance asks operators to build and test plans for running vital systems disconnected. The assumption underneath it is the story.
More than 30 Minnesota communities disrupted through internet-facing controllers. Manual operation was the fallback, and it is a capability most utilities are losing.
Unpatched vulnerability, persistent tooling, deleted logs. The deletion is a finding in itself — nobody spends that effort on a boring record.
Three million licence holders through a vendor the state chose. The data does not know it was collected for a fishing permit.
Five years of access with no exfiltration objective. Pre-positioning breaks every response method that starts by asking what the intruder wanted.
73,500 accounts on the state’s own messenger. For an internal platform the graph is the intelligence, not the messages.
About 11.7 million accounts on France’s national identity portal, and a detained fifteen-year-old. The age is the least useful fact in the file.
A cloud flaw touching Commission web properties, internal systems untouched. The second such file this year, and the boundary held both times.
The calculation is not that a city has money. It is that a city has visible pain and a decision-maker accountable to the people feeling it.
170,000 customer accounts at a regional monopoly. Metered consumption is an occupancy record, and customers cannot take their business elsewhere.
Permits, licences, records and billing offline by morning; 911 untouched. The separation that held is the kind budget reviews question.
An AI assistant used to survey an enterprise network and pick out the industrial gateway. No new exploit — a compressed analyst step.
A 139 TB claim against a national identity register, and issuance halted. A biometric register has no reissue path.
Ten months in a diplomatic academy’s education platform, touching 360 serving diplomats. The coursework was never the point; the roster was.
No data taken, no notification owed, 70,000 people unable to pay a bill. Availability fails independently of confidentiality.
Detected and remediated in about nine hours, with exposure limited to names and numbers. Fast containment is a decision, not luck.
Two cities, two attacks, dispatch survived both. The cost is annual and questioned; the benefit is a disaster that cannot be evidenced.
An Office zero-day opening the year against Ukraine and its partners. The unchanged target list matters more than the exploit.
Two days on manual processes with essential services maintained. The difference between a continuity document and a capability shows in the first hour.
The Bill was published thirteen days before three boroughs went down, and would not reach the nursery group.
In many countries these are the most complete identity datasets in existence, and the state’s dataset is not one you can leave.
Formal documents are the version a government is prepared to publish. Email is where the decision was actually made.
The redundancy people assume exists between channels frequently does not exist in the infrastructure.
The only reliable incident costs in this corpus come from organisations that had no choice but to publish them.
Three separately checkable claims in one sentence, against a corpus full of “certain information may have been accessed”.
Holiday timing is not a coincidence. And a resident who needs a permit has exactly one place to get it.
Prevention will fail. Detection is what determines whether that becomes a state government offline for 28 days.
Public bodies consolidate IT because they cannot each afford it, and the consolidation converts one compromise into a portfolio.
The litigation mechanism this corpus calls the fastest accountability route suppresses the most useful output an incident can produce.
A perimeter appliance is not a long-tail asset competing for attention. It is the front door.
Cities do not recover differently. They simply cannot stop describing it.
One ERP zero-day, 29 named victims across unrelated sectors, nothing encrypted. Theft-and-publication at industrial scale.
Nevada is not a more instructive incident than the other 398. It is a better documented one.
A social services outage means a benefit application does not progress for somebody who applied because they had nothing.
The variable that predicts the outcome is not the payment decision. It is whether you could recover without them.
A company can raise prices. A county cannot — more security means visibly less of something a resident can see.
Sixty agencies at once means something common to all of them fell. Consolidation working as designed, failing all at once.
The most sensitive records in this corpus, held by the least resourced organisations, under the thinnest supervision.
One paid and the data circulated. One refused and the data was published. The difference in outcome is the money.
The only action in this database that produces a certain answer to “are they still in?”
A state capital did not have the capacity to respond without help. For a city, the failure to invest was not a choice against an alternative.
The people worst affected are the ones with the fewest alternatives — and a city cannot defer its statutory duties while the systems are down.
The sector best measured in one jurisdiction is thinly recorded in another — a statement about supervisory publication, not about the banks.
A crash report exists because someone was in a collision. No vulnerability was exploited — a valid account did a permitted thing 300,000 times.
The employee did go looking for the official site. The search platform put something else first.
The employee was doing their job. The action was correct in every previous instance.
Benefits records identify people by their need for support, and 59% of the state was in them.
A wrong assurance cost nothing. A correct correction cost a lawsuit and months under an order.
A rule that only ever withholds is not a rule about evidence; it is a policy of silence. Here the threshold was met.
Once identity is compromised, a reset performed over the phone is exactly the mechanism it is trying to undo. The only remaining verifier is a face.
The case where the availability cost is documented and the confidentiality count is the footnote.
What was restrained was not the data. It was one person’s ability to look at it and describe what he found.
Presenting "encrypted" and "corrupted" as interchangeable makes an accident of the attacker’s process sound like a defence.
Residency is not a customer relationship. There is no competitor to move to and no contract to renegotiate.
A resident who needs to pay a water bill has one counterparty and no alternative.
Someone who found work in 2006 had no route to ask for their record to be removed.
No intruder, no exploit. A statutory duty answered, and a tab nobody checked.
The people who asked to be left off the public register were in the breach anyway.
A token signed with a trusted key is not a forgery the platform can detect. It is a valid token.
The federal files were a twentieth of the dump. The rest belonged to everyone else the supplier served.
Every other consumer file here involves someone who chose a company. Here the population is everyone who needed to drive.
The only file here where the recorded harm is entirely prospective. The point was to be there later.
The alert fired in ten minutes. The device stayed on the network for 58 hours.
A population the holder cannot notify without defeating the reason it holds the data.
The distribution channel an organisation trusts most is the one that reaches everything.
The fallback kept the state running, and put a month of government correspondence in consumer mailboxes.
The refusal was right. The people who paid for it were children who cannot freeze a credit file.
Ten bitcoin across a billion people is a fraction of a cent each. That is the market price.
Tax collection stopping is fiscal. Customs stopping means the containers do not move.