Annex / CB-235-A

Join recipes

The intelligence

A reference catalog of correlation patterns, each documented against a published case from the late 1990s onward, with a field audit checklist. Companion to CB-235. It lets an analyst hold a corpus or a breach record against known patterns and ask what role it could play in one, rather than judging it only by how sensitive its fields look. For analysts, data owners and security functions deciding what to collect, release or retain, or assessing what a breach exposed.

COMMAND intelligence

Unlock this Command Brief.

Get this assessment, the full subscription collection, and new intelligence as it is published.

Introductory rate · through 30 November

$75/month

For your first year, then $100/month. Or $750 for the first year, then $1,000 annually.

The CORGI Morning Brief, each morning
This brief and the subscription collection, 100+ briefs
New Command Briefs as they are released
Principal and Analyst briefs, as PDF

Subscribe to COMMAND

Secure checkout through Substack. Substack asks for your email first.

Full subscription details

Topics

Aggregation & Identity ResolutionResidential ExposureThreat Doctrine

Follow the thread

Cross-referenced intelligence.

CB-235subscription

Command Brief

The file that was never breached

You Named Your Car

In March 2025 a website called DogeQuest published a searchable map of purported Tesla owners' home addresses, though Tesla had not been breached. This brief traces where the published records came from and asks how such a roster should be assessed, and by whom. Built from the firm's own investigation of the published set, public reporting and earlier documented re-identification cases. For advisors deciding how far an exposure assessment should look beyond a principal's own breach history.

Aggregation & Identity ResolutionResidential ExposureThreat Doctrine

2026-08-27View record

CB-232subscription

Command Brief

The cost of a name

Nothing New Was Stolen

After Genesis Market was seized in April 2023, credentials recovered from the stolen-identity marketplace went to the lookup service Have I Been Pwned. Taking that sequence as its case, this brief asks what it costs someone holding only a principal's name to make leaked records usable, and what a breach-monitoring hit shows. Built from Justice Department and Europol accounts and public index records. For family offices and advisors reading monitoring results.

Breach & Leaked DataAggregation & Identity ResolutionThreat Doctrine

2026-08-27View record

CB-233subscription

Command Brief

Age is not decay

The Thieves Kept It Fresh

Most breach scoring works at the level of the incident, weighing how sensitive the haul was and how long ago it was taken. This brief asks what elapsed time does to exposed personal data, and which date on a breach record should govern that judgment. Built from federal authentication standards, Federal Reserve research, Census mobility data and accounts of a stolen-identity marketplace. For analysts weighing whether an old exposure can be set aside; it closes the run begun in CB-230.

Threat DoctrineAggregation & Identity ResolutionPretexting & Scams

2026-08-27View record

CB-234subscription

Command Brief

The breach is not the exposure

The Quiet Is Always Reassuring

Four earlier briefs, CB-230 through CB-233, each took up one step in the usual handling of a breach, from notice through payment to the passing of time. This brief reconciles them, asks what structured description of a principal's exposure should replace an incident-centered record, and states where the earlier briefs are superseded. Built from their cases read across one another. For analysts and family offices building or buying an exposure-scoring instrument.

Threat DoctrineBreach & Leaked DataThreat Modeling

2026-08-27View record

CB-072registered

Command Brief

Buy the file: what correlation assembles without a breach

They Used to Need Spies

In May 2026 a seller listed a 340-million-record correlation dataset tied to a subscription platform he had never breached. This brief works through what that implies for principals who believe they have not been exposed, and where the defensive window actually sits. Built from the reporting on that incident, the earlier state-linked aggregation intrusions, regulator actions on bidstream data and long-standing re-identification research. For principals and advisors assessing whether footprint reduction is still worth doing.

Aggregation & Identity ResolutionData BrokersBreach & Leaked Data

2026-05-01View record