Protective intelligence
ObscureIQ / Intelligence deskIndependent analysis. Protective judgment.
← Back to the libraryRecord / CB-234-A
Annex / CB-234-A

Four false equivalences

The intelligence

A one-page check sheet, companion to CB-234, that sets the central arguments of CB-230 through CB-233 side by side. It lets an analyst take any incident record handed over, whether a notice, a closed case or a monitoring result, and test separately what that record is being read to establish. Useful at intake, before anything about a breach is entered in a principal's file as settled. For analysts and family offices maintaining exposure files.

COMMAND intelligence

Unlock this Command Brief.

Get this assessment, the full subscription collection, and new intelligence as it is published.

Introductory rate · through 30 November
$75/month

For your first year, then $100/month. Or $750 for the first year, then $1,000 annually.

  • The CORGI Morning Brief, each morning
  • This brief and the subscription collection, 100+ briefs
  • New Command Briefs as they are released
  • Principal and Analyst briefs, as PDF
Subscribe to COMMAND

Secure checkout through Substack. Substack asks for your email first.

Full subscription details

Topics

Breach & Leaked DataThreat DoctrineThreat Modeling
Follow the thread

Cross-referenced intelligence.

CB-230subscription
Command Brief

What a breach notice cannot establish

The Search Engines Knew First

In January 2019 a federal regulator, not the company, alerted the clearinghouse Inmediata that patient records it held were indexed by search engines; settlements followed years later. Reading that case against three state notification statutes, this brief asks what a breach notice can tell a recipient about where the data stands today. For advisors and family offices deciding how to log and weigh the notices a household receives, and the first of a series running to CB-234.

Breach & Leaked DataPrivacy Law & RegulationThreat Doctrine
View record
CB-231subscription
Command Brief

What payment cannot buy

Nobody Lied About Deleting It

In 2024 UnitedHealth's chief executive told Congress he had authorized a ransom payment after the Change Healthcare intrusion. This brief asks what a payment, or an incident declared resolved, can establish about the data taken, and how an exposure file should read afterward. Built from that testimony, contemporaneous reporting, a law-enforcement statement after the LockBit seizure and research on post-payment outcomes. For advisors and family offices deciding when an exposure file may close.

Breach & Leaked DataCrisis ResponseThreat Doctrine
View record
CB-232subscription
Command Brief

The cost of a name

Nothing New Was Stolen

After Genesis Market was seized in April 2023, credentials recovered from the stolen-identity marketplace went to the lookup service Have I Been Pwned. Taking that sequence as its case, this brief asks what it costs someone holding only a principal's name to make leaked records usable, and what a breach-monitoring hit shows. Built from Justice Department and Europol accounts and public index records. For family offices and advisors reading monitoring results.

Breach & Leaked DataAggregation & Identity ResolutionThreat Doctrine
View record
CB-233subscription
Command Brief

Age is not decay

The Thieves Kept It Fresh

Most breach scoring works at the level of the incident, weighing how sensitive the haul was and how long ago it was taken. This brief asks what elapsed time does to exposed personal data, and which date on a breach record should govern that judgment. Built from federal authentication standards, Federal Reserve research, Census mobility data and accounts of a stolen-identity marketplace. For analysts weighing whether an old exposure can be set aside; it closes the run begun in CB-230.

Threat DoctrineAggregation & Identity ResolutionPretexting & Scams
View record
CB-234subscription
Command Brief

The breach is not the exposure

The Quiet Is Always Reassuring

Four earlier briefs, CB-230 through CB-233, each took up one step in the usual handling of a breach, from notice through payment to the passing of time. This brief reconciles them, asks what structured description of a principal's exposure should replace an incident-centered record, and states where the earlier briefs are superseded. Built from their cases read across one another. For analysts and family offices building or buying an exposure-scoring instrument.

Threat DoctrineBreach & Leaked DataThreat Modeling
View record