Office of the Privacy Commissioner (New Zealand)

Intruders reached Mathspace's unpatched Metabase four days after the fix shipped

Metabase published a critical fix on August 6, Mathspace's escalation process never surfaced it, and by the time the update went in on August 29 an intruder had been inside the reporting instance for 19 days and had already exported 1,079,819 records.