Across 903 companies, the dominant breach mechanism is not an attack on the company whose name is on your receipt. It is a compromise at a vendor you have never heard of, which then reaches dozens of unrelated companies simultaneously.
Why it matters
Choosing a different airline, lab, gym, hotel or dealership provided ZERO protection in every one of these cases. The security boundary that actually determines your exposure sits several companies removed from the one you gave your data to, and no privacy policy names it. This is the finding a consumer can act on least and needs to understand most.
Shared enforcement actions
Enforcement actions in this database that are linked to more than one company record. Each spoke is one link from the action to a record; every spoke is the same length because a link has no size. Links marked “candidate link — under review” have not been reviewed.
SITA (6 airlines at once) - AMCA (Quest 11.9M + Labcorp 7.7M, then went bankrupt) - MOVEit (reported victims include Delta Dental, AutoZone, Corebridge, dozens more) - Salesloft/Salesforce (~760 orgs, ~1.5B records per attacker claims) - CDK Global (thousands of car dealerships) - Otelier (Marriott confirmed; stolen data also referenced Hilton, Hyatt and Wyndham) - Mindbody (2018 FitMetrix exposure; specific gym-chain customers not confirmed) - PBI Research (reported: much of the life insurance sector) - Snowflake (Ticketmaster, Advance Auto Parts, AT&T)