Kind of like saying I have 10. 10 what? As my math/science teachers always said, don't forget to include your units.
Maybe the world needs a standardized place to catalog and rank all the data breaches that have been disclosed.
The disk size does not matter, and when the severity was actually determined it would show up in the headlines as "Boeing leak determined to be a level 3 leak" instead of just being "That boeing leak 5 months ago was kinda bad".
Either way, listing the size says very little.
Relevant quote from the article: "I haven’t gone over the whole data set but Boeing emails and a few others stand out as useful for those with malicious intent"
Both journalists and the public need a better way to understand how different breaches affect them.
If anything this would create two stories where there now is one, so journalists would not have less or later to report.
What does autism have to do with having the professional integrity to understand what it is you're writing about before publishing sensational claims?
They leaked 45 GB of data. That is all that is known, and therefore all that can be reported. Anything else is speculation until an investigation is done. That would be for a later followup report.
And second, even if a company has no idea of the scope, the hackers would somehow want to prove at least privately what the scope was, else their threat is not as manipulative as it could be. On the other hand, the hackers can't credibly bluff and inflate the scope too far beyond reality because the company can just say "prove it or I don't believe you and I won't pay." And the hackers want to get paid.
It's a business deal after all. A really crappy one involving criminals. But at the end of the day, the company must have already assessed the value of the leak in order to reach a decision.
I've seen companies say this sort of thing with high confidence. But that seems hard to me, assuming some level of administrative access was breached.
They asked for almost a million USD. FBI got involved, everything was restored from backups (thankfully, a month loss of digitalized work, and absolutely nothing was given to the ransomware group.
To your point, there are severe regulatory issues that have to be addressed due to the exfiltration. I no longer work for them, so I don't know the extent of their cost in 1. notifying affected clients and 2. providing credit protection coverage due to leaking of personal data.
Groups that leak are likely to want to inflate the severity of the leak to ensure they get paid.
The larger a leak, the higher the probability there’s sensitive information in there, and the better opportunities/more time attackers had to exfiltrate it.
The info says nothing, it conveys nothing. Even skipping the size and saying it leaked "emails" says more in the headline than the size.
A single video recording of an all-hands meeting could fill that size but it could also be emails containing the keys for accessing a large part of DOD.
No news org is going to go through that effort.
I think that is a good way of measuring it.
There are bluray movies larger than this leak and there are files smaller than 10kb a lot more critical in most businesses.
It'd be nice if there was some sort of scale for data leaks like (just spitballing here):
1. Leak destroys all core company functions (crypto-exchange leaks all wallet keys, CA leaks all root keys and becomes banned from all trust stores, etc.)
2. Leak causes regulatory issues criminal enough to shut down company
3. Leak severely hinders core company functions (deploy keys for a cloud computing SaaS are deleted which stops all new deployments until all infra is reconfigured)
4. Leak severely looses company competitive advantages (new products leak that are replicable by competitors)
5. Leak causes severe PR disaster
6. Leak shows embarrassing internal company communication without any of the above