The resilience of a nation’s communications, held as a private company’s operational decision.
More than 600 organisations across 80 countries since 2019, including US carriers and the lawful-intercept systems they run. The metadata was always the point.
A third-party software flaw reached email accounts across six Japanese providers. Choosing a different ISP bought no independence.
Carriers are the target, the transit and the only party who can see an individual compromised device. The benefit of acting accrues to everyone else.
A vishing call against an employee’s Entra account, then customer records in a connected CRM. The reported total has moved from 4.9 million upward.
Four botnets, three million consumer devices, a record 31.4 Tbps. The record measures domestic bandwidth growth, not attacker skill.
6.2 million subscribers over a weekend. Weekend timing is the one adversary behaviour you can plan against precisely.
A number identifies a billing relationship. It now secures banking and government access, and the depending services cannot see a port request.
Most victims had no opportunity to behave differently. The failure was entirely at the carrier, and awareness training addresses none of it.
The duty sits with the originating carrier because nobody else can act. It pushes directly against portability rules written by the same regulator.
Where fibre runs, which routes carry which customers, where the single points of failure sit — a dependency map for organisations that were never asked.
Content tells you what a known person said. Metadata tells you who the people are — and it is the one that scales.
An ecosystem-wide long tail alongside sector concentration. Both are true, and it complicates the corpus’s own argument.
Where a sector has four participants, two incidents approach population-scale coverage.
Lodging looks out of place on that sector list. It is not — hotels, transport and telecom metadata resolve a person’s movement over time.
A card number is reissued in days. An IBAN is tied to a relationship most people keep for decades.
A hotel record is the join key that turns location-adjacent data into confirmed physical presence. No DPIA has a field for that.
The data followed the obligation and the supervision did not follow the data.
When the number favours the jurisdiction this corpus covers best, the same discount applies.
444 counts events. 133 counts things somebody assessed as saleable and put on the market.
A sector whose failure would degrade the response to every other incident in this database.
Nobody attacks a satellite. Every practical route to a constellation runs through a building with a remote management link.
The vulnerability was not a defect in the implementation. It was the specification — and the thirty-year exceptional-access debate now has an empirical entry.
Sanctions work against organisations that need the financial system. A state intelligence service has no revenue to interdict.
Advice to change your own behaviour is what a defender issues when it cannot change the thing that is broken.
Eighty seconds is less time than it takes to read an alert. A defence that depends on somebody noticing has already lost.
A card can be reissued in days. A bank account number is the account.
Nothing in the design distinguishes a lawful request from an unlawful one. That distinction lives entirely in the process wrapped around it.
There is no moment at which the attacker chooses to be seen — which is the moment most of this database is built around.
A number is not a name until somebody looks it up, and looking it up is trivial. What the set contains is a contact graph.
A notification count is a floor, not a total. It covers who the company could name.
Six days between patch and intrusion. Faster than most manage, and longer than the window now exists.
The missing measurement is not lost revenue. It is warnings that did not reach people.
The mechanism for reaching the company was part of the same incident.
Six weeks to notice, one day to fix. Time to fix is almost never the constraint.
There was no exploit. The endpoint answered anyone who asked, because nothing asked who was calling.
Germany was not the target. The turbines were on the same satellite, and the wiper did not check.