Customer data leaked at a retailer serving 4.8 million. That figure is the customer base, not the affected count — and the distinction keeps getting lost.
Post-incident guidance that leads with the exposed device rather than the adversary. For a utility with one engineer, that is the usable document.
More than 30 Minnesota communities disrupted through internet-facing controllers. Manual operation was the fallback, and it is a capability most utilities are losing.
170,000 customer accounts at a regional monopoly. Metered consumption is an occupancy record, and customers cannot take their business elsewhere.
No data taken, no notification owed, 70,000 people unable to pay a bill. Availability fails independently of confidentiality.
Almost everything in this database stops at the IT boundary. Industrial-device compromise produces consequences that cannot be restored from backup.
Fifteen filings is fifteen more than exist for most industries here. The level is uninformative; the trend will not be.
The equipment is not unpatched through neglect. It is unpatchable — commissioned to run continuously for thirty years, by a vendor that may no longer exist.
A contractor breach adds a route that segmentation does not address, because the contractor’s access is legitimate by design.
Every playbook assumes an event. Pre-positioning has none — the adversary is deliberately behaving like an administrator.
Disclosing an attempt reveals detection capability. Holding it is not a compliance failure — it is the point.