I've seen attacker breach a gov-app. I had a unique email on that system that was then mailed an offer to buy the database and application code (for like 18USD in BTC at the time) The sample attached to the message had a CSV with like 2200 emails, users and gov addresses. Amazing, the vendor is still there and the agency kinda brushed it under the rug.

E: found an article here

https://www.thenewstribune.com/news/local/article199383069.h...