Four arrested over attacks assessed in the hundreds of millions. Three were teenagers, and the technique was a phone call.
Twenty-seven thousand employees queued in person to reset a password. That is what a broken identity system looks like.
The contract moves the work, the staffing and the cost. It does not move the consequence of resetting the wrong person’s credential.
A phone call to an outsourced service desk, a password reset, and £270–440 million across two retailers assessed as one event.
Three retailers, one crew, one window. The reusable asset is the shared supplier estate behind the brands.
Removing seven participants from a population defined by willingness rather than skill leaves the population substantially intact.
An unsophisticated technique that works is not a lesser threat than a sophisticated one. It is a worse one.
By the final phase there was no peer sector to watch, because the target was defined by a product rather than an industry.
A safety regime, built for other purposes, produced the segmentation that a security argument has repeatedly failed to fund elsewhere.
An airline reading about Hawaiian on a Monday had, at most, a fortnight.
An authentication estate is only as strong as its weakest enabled option — and disabling produces an outage with a name attached.
A caller claiming to be an agent locked out before a client meeting is making a request the function exists to grant, dozens of times a day.
The reporting duty tracks the sensitivity of the record. The security expectation tracks the sector of the company.
A notification arriving from an entity the recipient may not recognise as connected to the shop.
A group that works one industry at a time is reusing research, not expressing a preference. That makes the next target legible.
Notifications usually describe a subset. Co-op did not have that sentence available — a loyalty scheme is built to be complete.
£206 million in revenue that never arrived. Groceries are perishable and demand is not deferred — the loss is permanent in a way a car maker’s is not.
A rule that only ever withholds is not a rule about evidence; it is a policy of silence. Here the threshold was met.
Once identity is compromised, a reset performed over the phone is exactly the mechanism it is trying to undo. The only remaining verifier is a face.
The case where the availability cost is documented and the confidentiality count is the footnote.
A breach notification counts records. It has no field for a fortnight of manual check-in.
Paying bought silence about data already copied. None of the $15m was spent on the members.