The published “we don’t hit hospitals” rules were positioning. An operation whose affiliates pick the victims cannot implement a sector exclusion.
A wrong assurance cost nothing. A correct correction cost a lawsuit and months under an order.
What was restrained was not the data. It was one person’s ability to look at it and describe what he found.
Presenting "encrypted" and "corrupted" as interchangeable makes an accident of the attacker’s process sound like a defence.
Residency is not a customer relationship. There is no competitor to move to and no contract to renegotiate.
Reporting follows interest. The harm that is interesting gets recorded; the harm that is serious sometimes does not.
It gained nothing by publishing the route, and published it anyway. That is the standard.