A claimed 2.2 million records. Long-lived brands hold data collected across decades, terms and regulatory regimes nobody has reconciled.
Not one obligation with fifty deadlines — fifty obligations that overlap. It explains why affected counts keep climbing.
Espionage acquires data covertly at cost and risk. The same categories are purchasable, leaving no incident for anyone to file.
The duty sits with the originating carrier because nobody else can act. It pushes directly against portability rules written by the same regulator.
A rule cannot make a help-desk conversation resistant to a plausible caller. Compliant organisations appear in this database as often as non-compliant ones.
An open API at 25,000 queries a day and an agent portal with a password and nothing else. The first time a regulator priced the quote form.
A guidance document with no penalty attached. It put the insurer, the negotiator and the forensics firm on the hook for where the money went.