The file that was never breached

Buy the file: what correlation assembles without a breach

They Used to Need Spies

In May 2026 a seller listed a 340-million-record correlation dataset tied to a subscription platform he had never breached. This brief works through what that implies for principals who believe they have not been exposed, and where the defensive window actually sits. Built from the reporting on that incident, the earlier state-linked aggregation intrusions, regulator actions on bidstream data and long-standing re-identification research. For principals and advisors assessing whether footprint reduction is still worth doing.

The cost of a name

Nothing New Was Stolen

After Genesis Market was seized in April 2023, credentials recovered from the stolen-identity marketplace went to the lookup service Have I Been Pwned. Taking that sequence as its case, this brief asks what it costs someone holding only a principal's name to make leaked records usable, and what a breach-monitoring hit shows. Built from Justice Department and Europol accounts and public index records. For family offices and advisors reading monitoring results.

Age is not decay

The Thieves Kept It Fresh

Most breach scoring works at the level of the incident, weighing how sensitive the haul was and how long ago it was taken. This brief asks what elapsed time does to exposed personal data, and which date on a breach record should govern that judgment. Built from federal authentication standards, Federal Reserve research, Census mobility data and accounts of a stolen-identity marketplace. For analysts weighing whether an old exposure can be set aside; it closes the run begun in CB-230.

The breach is not the exposure

The Quiet Is Always Reassuring

Four earlier briefs, CB-230 through CB-233, each took up one step in the usual handling of a breach, from notice through payment to the passing of time. This brief reconciles them, asks what structured description of a principal's exposure should replace an incident-centered record, and states where the earlier briefs are superseded. Built from their cases read across one another. For analysts and family offices building or buying an exposure-scoring instrument.

What a breach notice cannot establish

The Search Engines Knew First

In January 2019 a federal regulator, not the company, alerted the clearinghouse Inmediata that patient records it held were indexed by search engines; settlements followed years later. Reading that case against three state notification statutes, this brief asks what a breach notice can tell a recipient about where the data stands today. For advisors and family offices deciding how to log and weigh the notices a household receives, and the first of a series running to CB-234.

Join recipes

A reference catalog of correlation patterns, each documented against a published case from the late 1990s onward, with a field audit checklist. Companion to CB-235. It lets an analyst hold a corpus or a breach record against known patterns and ask what role it could play in one, rather than judging it only by how sensitive its fields look. For analysts, data owners and security functions deciding what to collect, release or retain, or assessing what a breach exposed.