#Breaches

78.8 million records. DOJ indicted Fujie Wang (May 2019) — spear-phishing, Sakula malware, lateral movement over months. Names, SSNs, medical IDs, employment info, income data. Same malware tools (Sakula, Mivast/Derusbi) used exclusively by Chinese APT campaigns.

The thesis: every surveillance capability governments build eventually gets turned against them.

Flo Health FTC settlement: Shared data from millions of users with Facebook, Google despite privacy promises. Didn’t stop until 2019 WSJ exposé. FTC finalized order June 2021. In 2025, Google paid $48M, Flo $8M, and Flurry $3.5M (total $59.5M).