A compromise at a third-party ticketing platform used by EY’s IT staff. Ticket attachments hold whatever was needed to reproduce the problem.
Up to six million customers exposed in 2025; records published in 2026. Notification law assumes an incident that ends.
Customer data through a supplier, with the airline flying normally throughout. Aviation now appears here through both operations and data.
Another luxury house through another third-party platform. Discretion is part of what the customer is buying.
Publication is its own phase, timed for reasons unrelated to the victim. Nobody is required to tell affected people when it happens.
Whatever the constraint was, it was not budget, headcount, expertise or tooling.
The bureau’s customers are lenders. The people in the database are its product.
The peer-warning argument only helps organisations that are not first. Hindsight makes May look like August.
Applied for a job, was not hired, and handed over a social security number to be considered.
Customers learned their data had gone, and could not learn from whom.