Encrypted five days before a change of government, a day after the national CERT warned about ransomware.
Customer data leaked at a retailer serving 4.8 million. That figure is the customer base, not the affected count — and the distinction keeps getting lost.
Post-incident guidance that leads with the exposed device rather than the adversary. For a utility with one engineer, that is the usable document.
Unpatched vulnerability, persistent tooling, deleted logs. The deletion is a finding in itself — nobody spends that effort on a boring record.
About 11.7 million accounts on France’s national identity portal, and a detained fifteen-year-old. The age is the least useful fact in the file.
170,000 customer accounts at a regional monopoly. Metered consumption is an occupancy record, and customers cannot take their business elsewhere.
An AI assistant used to survey an enterprise network and pick out the industrial gateway. No new exploit — a compressed analyst step.
Ten months in a diplomatic academy’s education platform, touching 360 serving diplomats. The coursework was never the point; the roster was.
No data taken, no notification owed, 70,000 people unable to pay a bill. Availability fails independently of confidentiality.
The Bill was published thirteen days before three boroughs went down, and would not reach the nursery group.
In many countries these are the most complete identity datasets in existence, and the state’s dataset is not one you can leave.
The only reliable incident costs in this corpus come from organisations that had no choice but to publish them.
Three separately checkable claims in one sentence, against a corpus full of “certain information may have been accessed”.
Public bodies consolidate IT because they cannot each afford it, and the consolidation converts one compromise into a portfolio.
The litigation mechanism this corpus calls the fastest accountability route suppresses the most useful output an incident can produce.
One ERP zero-day, 29 named victims across unrelated sectors, nothing encrypted. Theft-and-publication at industrial scale.
Nevada is not a more instructive incident than the other 398. It is a better documented one.
A social services outage means a benefit application does not progress for somebody who applied because they had nothing.
The variable that predicts the outcome is not the payment decision. It is whether you could recover without them.
A company can raise prices. A county cannot — more security means visibly less of something a resident can see.
The most sensitive records in this corpus, held by the least resourced organisations, under the thinnest supervision.
One paid and the data circulated. One refused and the data was published. The difference in outcome is the money.
A crash report exists because someone was in a collision. No vulnerability was exploited — a valid account did a permitted thing 300,000 times.
The employee did go looking for the official site. The search platform put something else first.
The employee was doing their job. The action was correct in every previous instance.
The case where the availability cost is documented and the confidentiality count is the footnote.
Presenting "encrypted" and "corrupted" as interchangeable makes an accident of the attacker’s process sound like a defence.
Residency is not a customer relationship. There is no competitor to move to and no contract to renegotiate.
The people who asked to be left off the public register were in the breach anyway.
A token signed with a trusted key is not a forgery the platform can detect. It is a valid token.
The alert fired in ten minutes. The device stayed on the network for 58 hours.
A population the holder cannot notify without defeating the reason it holds the data.
The distribution channel an organisation trusts most is the one that reaches everything.
The fallback kept the state running, and put a month of government correspondence in consumer mailboxes.
The refusal was right. The people who paid for it were children who cannot freeze a credit file.
Tax collection stopping is fiscal. Customs stopping means the containers do not move.