600,000 claimed, 185,300 verified — and a franchise structure where the brand, the data holder and the notifier are three parties.
13.5 million accounts reachable because the environment was configured to permit it. Nobody had to be clever.
Hundreds of organisations claimed through public portals working exactly as configured. The guest user profile is a permission set nobody designed.