Three compromised laptops, corporate data taken, and a filing that answers the shareholder question only.
A name concatenated from three crews. Attribution language implies a roster, and a coalition brand quietly breaks that implication.
Most of 1.4 million customers, advisers and employees. A CRM accumulates every population an organisation tracks, and so does its blast radius.
Separate houses, one platform. A luxury purchase history is a map of where valuable objects live.
The contract moves the work, the staffing and the cost. It does not move the consequence of resetting the wrong person’s credential.
A phone call to an outsourced service desk, a password reset, and £270–440 million across two retailers assessed as one event.
967,000 accounts at a lending platform. Underwriting assembles identity, income and obligations — including for people who were declined.
Removing seven participants from a population defined by willingness rather than skill leaves the population substantially intact.
This desk files the enterprise version as adversary tradecraft and the consumer version as carelessness. That distinction does not survive the comparison.
Arrests, a conviction, federal warnings and regulator alerts. None of them stopped a November incident using an April technique.
A regulator receiving a dozen filings describing the same technique could warn the market. That is not a new obligation — it is a use of filings that already exist.
Criminal activity does not scale thirtyfold in a year. Reporting does.
A boundary between corporate systems and customer tenants held under live attack. This corpus rarely gets to observe that.
A conviction is the highest-confidence attribution in this corpus — and it convicts a person, not a cluster, because the cluster is not an entity.
An unsophisticated technique that works is not a lesser threat than a sophisticated one. It is a worse one.
Reachable, taken, and published are three populations. Almost every affected count in this database is one of them without saying which.
By the final phase there was no peer sector to watch, because the target was defined by a product rather than an industry.
The blast radius of a successful social-engineering call is set by an architectural decision made elsewhere — and nobody makes that decision thinking about social engineering.
A safety regime, built for other purposes, produced the segmentation that a security argument has repeatedly failed to fund elsewhere.
An airline reading about Hawaiian on a Monday had, at most, a fortnight.
A caller claiming to be an agent locked out before a client meeting is making a request the function exists to grant, dozens of times a day.
The reporting duty tracks the sensitivity of the record. The security expectation tracks the sector of the company.
A service desk supporting agents and brokers is supporting people it does not know by sight.
A group that works one industry at a time is reusing research, not expressing a preference. That makes the next target legible.
Notifications usually describe a subset. Co-op did not have that sentence available — a loyalty scheme is built to be complete.
£206 million in revenue that never arrived. Groceries are perishable and demand is not deferred — the loss is permanent in a way a car maker’s is not.
This database has 350 files and none of them cover a stolen phone — because it produces no notification and no defendant.
The second move works because the first one is real. The employee has a genuine problem, and internal IT has arrived unprompted to solve it.
At better than one in four per year, the burden this industry places on individual vigilance is not one any population could carry.
A breach notification counts records. It has no field for a fortnight of manual check-in.
Paying bought silence about data already copied. None of the $15m was spent on the members.
Costly to the refuser, costless to everyone else. The only one in the database like that.
The second factor was not bypassed. It was delivered to the right person, who said yes.
What differed from the largest files here was not the method. It was whose desk it was.