Materiality asks whether an investor would want to know. Whether patients are harmed is a different question.
455,000 addresses across decades of cohorts. An alumni relationship has no end date and no opt-out.
The most heavily governed system in the organisation, with a dependency path that has no governance attached to it.
6.2 million subscribers over a weekend. Weekend timing is the one adversary behaviour you can plan against precisely.
5.1 million loyalty accounts. Nothing sensitive by field name; a good deal sensitive by implication.
Almost everything in this database stops at the IT boundary. Industrial-device compromise produces consequences that cannot be restored from backup.
A client reads that their bank has had a breach. The bank’s systems were not compromised. Both are true.
Sanctions work against organisations that need the financial system. A state intelligence service has no revenue to interdict.
A support portal is a production system. 18,000 schools did not make 18,000 bad decisions — but the security did not scale with the concentration.
Containment converts an unbounded loss into a bounded one, and moves it onto whoever needed the service that week.
Nobody assessing a phone-system vendor thinks to ask about its staff’s trading software.