Two years for the participant who travelled, seven years after the conduct. The operators who built what came next were not in the room.
17 million devices sold as residential addresses. This is the component that defeats impossible-travel checks and geographic risk scoring.
The fact travels immediately; the detail follows when it is reliable. It is the structure this desk asked for at 25-1027.
A privately held operator using the same product would have had the same exposure and, quite possibly, produced no public record at all.
An open API at 25,000 queries a day and an agent portal with a password and nothing else. The first time a regulator priced the quote form.
MFA existed, on the firewall. The application said privileged access. The policy was unwound from the first day, a month after the ransomware.