The breach is not the exposure

What a breach notice cannot establish

The Search Engines Knew First

In January 2019 a federal regulator, not the company, alerted the clearinghouse Inmediata that patient records it held were indexed by search engines; settlements followed years later. Reading that case against three state notification statutes, this brief asks what a breach notice can tell a recipient about where the data stands today. For advisors and family offices deciding how to log and weigh the notices a household receives, and the first of a series running to CB-234.

What payment cannot buy

Nobody Lied About Deleting It

In 2024 UnitedHealth's chief executive told Congress he had authorized a ransom payment after the Change Healthcare intrusion. This brief asks what a payment, or an incident declared resolved, can establish about the data taken, and how an exposure file should read afterward. Built from that testimony, contemporaneous reporting, a law-enforcement statement after the LockBit seizure and research on post-payment outcomes. For advisors and family offices deciding when an exposure file may close.

The cost of a name

Nothing New Was Stolen

After Genesis Market was seized in April 2023, credentials recovered from the stolen-identity marketplace went to the lookup service Have I Been Pwned. Taking that sequence as its case, this brief asks what it costs someone holding only a principal's name to make leaked records usable, and what a breach-monitoring hit shows. Built from Justice Department and Europol accounts and public index records. For family offices and advisors reading monitoring results.

Age is not decay

The Thieves Kept It Fresh

Most breach scoring works at the level of the incident, weighing how sensitive the haul was and how long ago it was taken. This brief asks what elapsed time does to exposed personal data, and which date on a breach record should govern that judgment. Built from federal authentication standards, Federal Reserve research, Census mobility data and accounts of a stolen-identity marketplace. For analysts weighing whether an old exposure can be set aside; it closes the run begun in CB-230.

Four false equivalences

A one-page check sheet, companion to CB-234, that sets the central arguments of CB-230 through CB-233 side by side. It lets an analyst take any incident record handed over, whether a notice, a closed case or a monitoring result, and test separately what that record is being read to establish. Useful at intake, before anything about a breach is entered in a principal's file as settled. For analysts and family offices maintaining exposure files.