Protective intelligence
ObscureIQ / Intelligence deskIndependent analysis. Protective judgment.
← Back to the libraryRecord / CB-231
Command Brief / CB-231

What payment cannot buy

Nobody Lied About Deleting It

The intelligence

In 2024 UnitedHealth's chief executive told Congress he had authorized a ransom payment after the Change Healthcare intrusion. This brief asks what a payment, or an incident declared resolved, can establish about the data taken, and how an exposure file should read afterward. Built from that testimony, contemporaneous reporting, a law-enforcement statement after the LockBit seizure and research on post-payment outcomes. For advisors and family offices deciding when an exposure file may close.

COMMAND intelligence

Unlock this Command Brief.

Get this assessment, the full subscription collection, and new intelligence as it is published.

Introductory rate · through 30 November
$75/month

For your first year, then $100/month. Or $750 for the first year, then $1,000 annually.

  • The CORGI Morning Brief, each morning
  • This brief and the subscription collection, 100+ briefs
  • New Command Briefs as they are released
  • Principal and Analyst briefs, as PDF
Subscribe to COMMAND

Secure checkout through Substack. Substack asks for your email first.

Full subscription details

Topics

Breach & Leaked DataCrisis ResponseThreat Doctrine
Follow the thread

Cross-referenced intelligence.

CB-230subscription
Command Brief

What a breach notice cannot establish

The Search Engines Knew First

In January 2019 a federal regulator, not the company, alerted the clearinghouse Inmediata that patient records it held were indexed by search engines; settlements followed years later. Reading that case against three state notification statutes, this brief asks what a breach notice can tell a recipient about where the data stands today. For advisors and family offices deciding how to log and weigh the notices a household receives, and the first of a series running to CB-234.

Breach & Leaked DataPrivacy Law & RegulationThreat Doctrine
View record
CB-232subscription
Command Brief

The cost of a name

Nothing New Was Stolen

After Genesis Market was seized in April 2023, credentials recovered from the stolen-identity marketplace went to the lookup service Have I Been Pwned. Taking that sequence as its case, this brief asks what it costs someone holding only a principal's name to make leaked records usable, and what a breach-monitoring hit shows. Built from Justice Department and Europol accounts and public index records. For family offices and advisors reading monitoring results.

Breach & Leaked DataAggregation & Identity ResolutionThreat Doctrine
View record
CB-233subscription
Command Brief

Age is not decay

The Thieves Kept It Fresh

Most breach scoring works at the level of the incident, weighing how sensitive the haul was and how long ago it was taken. This brief asks what elapsed time does to exposed personal data, and which date on a breach record should govern that judgment. Built from federal authentication standards, Federal Reserve research, Census mobility data and accounts of a stolen-identity marketplace. For analysts weighing whether an old exposure can be set aside; it closes the run begun in CB-230.

Threat DoctrineAggregation & Identity ResolutionPretexting & Scams
View record