Count the consequences.
Not just the records.

THE ORIGINAL STUDY

Read the dataset before repeating its headline.

Lab 1’s report page describes analysis of 141 million files across 1,297 breaches. It reports financial data in 93% of incidents and IBANs in 36%. These are vendor-research findings about the analysed collection, not prevalence estimates for all breaches.

The page’s 54 email addresses per file is an aggregate measure. It does not imply 54 unique people in every file or 54 additional victims. Repeated addresses, large collections, and document types can affect an average.

Granular comparisons between institutions require the underlying tables and definitions. Volume, sensitivity, and relationship exposure measure different things; a large file count does not settle the consequences for every organisation named in the material.

THE CONTENT REVIEW

Classify what the information could enable.

Keep the evidence categories separate. A private key in an archive may be expired or still active; an internal directory may reveal valuable relationships without containing access credentials. A response based only on size can miss both the urgent action and the necessary qualification.

Use appropriate specialist handling for sensitive material. Incident analysis should not spread the dataset to more people than necessary or turn a response task into a new disclosure.

THE RELATIONSHIP EXPOSURE

Who is connected, and how?

The “blast radius” concept describes the reach of information beyond the initially affected business. Supplier names, correspondence, invoices, and staff roles can give a criminal a more convincing pretext for another approach.

But a named organisation is not necessarily compromised, exposed to the same degree, or obliged to take the same action. Record the relationship, information present, and plausible consequence before counting every reference as another victim.

For an affected supplier or customer, a useful notification says what is known, what is uncertain, and which action is warranted. A generic warning that “your data may be involved” can be hard to use without that context.

AUTOMATION & AI

Faster analysis does not remove the need to validate.

Automation can assist with searching, grouping, and identifying sensitive content in large unstructured collections. It also creates handling, confidentiality, and accuracy questions. Do not send exposed material into an unapproved service simply to obtain a faster summary.

Treat machine-generated classifications as findings to validate, especially where they drive legal, customer, or access decisions. Preserve the link to the source item and record uncertainty. A plausible label is not evidence that a document contains a live secret or describes an actual event.

The prospect that an attacker could automate analysis is a reason to improve readiness. It does not establish that every leaked HR record trained a voice clone, every code fragment produced an exploit, or a separate cloud outage proved the report’s model.

BEFORE & AFTER A BREACH

Make content awareness part of ordinary information management.

• Before: know where sensitive unstructured information is kept, who can access it, and when it can be removed.
• During: prioritise content that creates immediate access, financial, personal, or operational risk.
• After: verify revocation and other protective actions, review relationships, and reduce unnecessary retained information.

Legal assessment depends on the applicable duties and actual facts. Neither file count nor a modelled exposure score determines every reporting or notification obligation. Connect the evidence to the appropriate legal and business decision-makers.