Three compromised laptops, corporate data taken, and a filing that answers the shareholder question only.
Customer data leaked at a retailer serving 4.8 million. That figure is the customer base, not the affected count — and the distinction keeps getting lost.
Four arrested over attacks assessed in the hundreds of millions. Three were teenagers, and the technique was a phone call.
Five million records from a platform none of the customers knew they were using. Correlated failure, uncorrelated disclosure.
Up to six million customers exposed in 2025; records published in 2026. Notification law assumes an incident that ends.
An Oracle E-Business Suite flaw exploited in August 2025, found in June 2026. The records were employees’: identity documents, bank details, health data.
Valid credentials from somebody else’s breach, accepted. Nothing failed in the conventional sense, and customer data went anyway.
A phishing-led compromise affecting close to six million guests, including passport numbers a passenger could never have declined to provide.
Two years between the intrusion and the notification, on identity documents. Small organisations produce long intervals, and mostly go unrecorded.
Ten million claimed, 5.5 million verified. A leak-site figure is an advertisement written by the seller.
Separate houses, one platform. A luxury purchase history is a map of where valuable objects live.
600,000 claimed, 185,300 verified — and a franchise structure where the brand, the data holder and the notifier are three parties.
A hurricane-style category applied to a cyber event. Severity is a property of the victim and its coupling, not of the attack.
A phone call to an outsourced service desk, a password reset, and £270–440 million across two retailers assessed as one event.
Business systems encrypted; the segmented membership server untouched. Our database is mostly a record of controls that failed.
Three retailers, one crew, one window. The reusable asset is the shared supplier estate behind the brands.
5.1 million loyalty accounts. Nothing sensitive by field name; a good deal sensitive by implication.
Another luxury house through another third-party platform. Discretion is part of what the customer is buying.
Cards captured in flight through guest checkout. Storing nothing protects the database and not the customer.
Where a market has one dominant platform, the distinction between a customer list and a national register largely disappears.
What was counted is not what matters, and what matters was not counted.
There is no packet to inspect and no domain to block. The output of the call is a legitimate action by an authorised person.
No data involved, no system touched, no notification anywhere. The company simply could not trade.
Its own controls held in April. The data left in September through an estate it did not run.
837 incidents, 419 confirmed breaches. The 418 that never became a disclosure are the sector’s real attack volume.
An unsophisticated technique that works is not a lesser threat than a sophisticated one. It is a worse one.
Three brands, three jurisdictions, three timetables. The pattern exists only above the level anyone is obliged to report.
A retailer and a bank suffering identical intrusions produce very different invoices, and the difference is regulation rather than damage.
A notification arriving from an entity the recipient may not recognise as connected to the shop.
Limited fields, no financial data, low risk — the standard reassurance. It does not hold when being on the list is the sensitive fact.
A three-day e-commerce shutdown was a decision, not a failure. The delayed earnings release is the mandatory signal breach law never produces.
A group that works one industry at a time is reusing research, not expressing a preference. That makes the next target legible.
Notifications usually describe a subset. Co-op did not have that sentence available — a loyalty scheme is built to be complete.
£206 million in revenue that never arrived. Groceries are perishable and demand is not deferred — the loss is permanent in a way a car maker’s is not.
A stated plan costs nothing to announce and cannot be checked, and it raises pressure on the victim at no risk to the group.
Not the customer of a customer. The family of an employee of the breached company.
A slower process for tinned goods costs margin. A slower process for produce costs the produce.
An American software vendor’s outage changed what was on sale in British supermarkets.
The last four digits cannot buy anything. They are what the call centre asks for.
Applied for a job, was not hired, and handed over a social security number to be considered.
2.2 million against 45 million is not a disagreement about scope. One of them is wrong.
Customers learned their data had gone, and could not learn from whom.
A rule to collect identity documents, and no matching rule to dispose of them.
A restaurant chain without tills is not a degraded restaurant chain.
Data for sale reaches whoever pays. Data published free reaches everyone, permanently.
An organisation dealing with an incident should not assume it is dealing with an incident.
The unit that matters is not the facility. It is the number of organisations that stop when it does.
The customer headline and the actual victim population were different groups.