Customer data leaked at a retailer serving 4.8 million. That figure is the customer base, not the affected count — and the distinction keeps getting lost.
6.9 million driver’s licence numbers, a field that is neither ceremonially protected nor practically replaceable.
Five million records from a platform none of the customers knew they were using. Correlated failure, uncorrelated disclosure.
Revenue-cycle software for thousands of hospitals. Billing data is clinical data wearing an accounting costume.
1.4 million addresses, and instructor payout methods. A card can be reissued; a bank account configured to receive money cannot.
Ten million claimed, 5.5 million verified. A leak-site figure is an advertisement written by the seller.
“Battle-tested” is used as a security argument. A defect that survived 27 years of review in OpenBSD undercuts it.
229,200 driver’s licences at a lending platform, plus data for 797 broker firms. The licence is the KYC document other institutions trust.
Ten months in a diplomatic academy’s education platform, touching 360 serving diplomats. The coursework was never the point; the roster was.
6.2 million subscribers over a weekend. Weekend timing is the one adversary behaviour you can plan against precisely.