---
title: "Four Breaches, One Broken Label"
description: "Chris Clymer had me on his show to talk about my book, Cyber Risk is a Myth, and somewhere after the intro, we stopped talking about the book and started talking about four organizations that prove its thesis the hard"
url: https://kaynemcgladrey.com/blog/four-breaches-one-broken-label/
date: 2026-10-28
modified: 2026-10-28
author: "Kayne"
image: https://kaynemcgladrey.com/wp-content/uploads/2026/10/Cyber-Risk-is-a-Myth-The-Fractional-Leader.webp
categories: ["Blog"]
type: post
lang: en-US
---

# Four Breaches, One Broken Label

Chris Clymer had me [on his show](https://www.youtube.com/watch?v=HfQu9XrZQD0) to talk about my book, [Cyber Risk is a Myth](https://www.routledge.com/Cyber-Risk-is-a-Myth-A-Business-Approach-to-Integrated-Risk-Management/McGladrey/p/book/9781041249054), and somewhere after the intro, we stopped talking about the book and started talking about four organizations that prove its thesis the hard way. I’ve spent nearly three decades in this field watching the same pattern repeat, and it still catches people off guard when I say it out loud. Security risks are business risks. Slapping the word “cyber” in front of “risk” hands every non-technical executive a permission slip to stop paying attention, and the bill for that inattention always arrives with late fees attached.

If you’ve listened to the episode and want more details about each of the cases I’d mentioned, read on.

## The label is the problem

Order Express is a Chicago-based money transmitter licensed in New York, which put it under the New York State Department of Financial Services (NYDFS) and Part 500, the state’s cybersecurity regulation. On September 7, 2022, the company discovered ransomware had encrypted just over half its servers. Four years later, on August 3, 2026, NYDFS announced a consent order carrying $250,000 in penalties for three violations, signed by the chief operating officer of a company that employed nobody with “security” in their job title.

The detail that should trouble every executive sits in paragraph 13 of that order. Order Express conducted an annual risk assessment that considered operational risks and information technology risks, but it failed to consider cybersecurity threats, because cybersecurity sounded like a specialty for specialists who didn’t exist there. I [wrote about the consent order](https://kaynemcgladrey.com/blog/order-express-paid-250k-because-nobody-owned-the-risk/) in August, and the longer I thought about it, the more it looked like the whole industry’s problem compressed into one Midwestern money transmitter. They didn’t skip the assessment. They scoped it wrong, and the attackers found the blind spot before anyone inside the company did.

> The consent order gives away the whole game. The assessment was already happening. It just didn’t cover the right threats.

## Compliance is the floor, not the ceiling

OneTouchPoint should have been different. The Wisconsin print-and-mail vendor served more than thirty healthcare payers and providers, including Humana, Aetna, and a wall of Blue plans, which made it a business associate under the Health Insurance Portability and Accountability Act (HIPAA) sitting on subscriber data and health assessment answers. Revenue ran about $135.7 million, and intruders entered the network on April 27, 2022, with encrypted files turning up a day later.

Maine’s attorney general initially received a report of about 1.1 million affected people. After customers like Common Ground Healthcare Cooperative reported their own affected counts, the tally climbed to 2,651,396.

> A company whose entire business is knowing whose name goes on which envelope did not know how many people’s data it held.

Fourteen lawsuits followed across multiple jurisdictions, three mediations failed, a motion to dismiss was partially granted, and the parties eventually abandoned their own consolidated federal case and refiled in Waukesha County just to get the settlement approved. When I [ran the full numbers](https://kaynemcgladrey.com/blog/four-years-fourteen-lawsuits-136-million-in-revenue-what-onetouchpoints-ransomware-bill-actually-added-up-to/), the bill came to between $6.9 million and $14.5 million, with a mid estimate of $9.7 million. The settlement caps plaintiffs’ fees at $1.5 million and commits OneTouchPoint to roughly $2 million in security improvements over five years, certified by letter to class counsel. No auditor. No scheduled compliance reporting.

## The math behind each incident

### What the cases have in common

The pattern runs the same at every scale, from a 186-employee nonprofit to a $23 million money transmitter to a $135.7 million vendor to a half-billion-dollar lender. The loss-to-prevention ratio at ACCC runs from 7x to 54x, since the loss itself ran from $638,000 in hard cash to $2.15 million with remediation, while prevention ran between $40,000 and $90,000 a year depending on how the controls were bought. Fourteen years of security budget got consumed at OneTouchPoint, where a top-end program cost about $700,000 a year against a $9.7 million bill. Two percent of a year’s revenue at Academy Mortgage. Your size stops being an excuse.

| Organization | Year of Incident | Realized Cost | Revenue | Key Figure |
| --- | --- | --- | --- | --- |
| American Consumer Credit Counseling (ACCC) | 2025 | $2.15M | ~$8-12M (nonprofit) | 7x to 54x loss vs. prevention |
| OneTouchPoint | 2022 | $9.7M (mid) | $135.7M | ~7% of revenue |
| Academy Mortgage | 2023 | ~$9.8M | ~$500M+ | 2% of revenue |
| Order Express | 2022 | $250K + unknown | ~$23M | Scoping failure |

I’ve written separate deep dives on [ACCC’s settlement](https://kaynemcgladrey.com/blog/the-million-dollar-email-account/) and [Academy’s penalty](https://kaynemcgladrey.com/blog/academy-mortgages-data-breach-likely-cost-nearly-10-million-for-the-decisions-it-never-made/), and every figure above traces back to public documents.

### Why invoices beat projections

Annualized loss expectancy models fail executives here because the frequency term is a guess, and realized-loss accounting doesn’t have that problem, because the losses are documented. Settlement sites, Form 990s, consent orders, and 10k/8k data are all public and all free. Four of the five numbers in the formula are documented; only prevention is a forecast.

Claims payouts remain genuinely unknowable until the administrator reports, and breach class actions historically draw single-digit claim rates against a confirmed-impact class whose size is undisclosed.

## The next broken label is already here

On May 7, 2026, CB Financial Services, Inc., the holding company for Community Bank, filed a Form 8-K with the Securities and Exchange Commission (SEC) disclosing that an employee had pasted customer names, Social Security numbers, and dates of birth into an unauthorized external AI tool. I [wrote about the filing](https://kaynemcgladrey.com/blog/the-community-bank-wake-up-call/) at the time. Nobody files a securities disclosure over an approved experiment. The Office of the Comptroller of the Currency (OCC) made its position clear in March 2026 guidance, holding banks responsible for third-party AI tools regardless of who approved them.

Employees are using these tools anyway, and the fix is making the sanctioned path faster than the unsanctioned one. Courts are already treating AI chat logs as discoverable business records, so it’s worth updating retention schedules and making sure legal holds name AI tools explicitly. “AI risk” is the next word doing what cyber did, a label specialized enough that a non-technical executive feels entitled to look away.

## What a small business owner can do Monday morning

Most small businesses don’t need a fulltime CISO on payroll. They need the owner to ask three questions and write down the answers.

- Which business process generates the most revenue per hour, and what does it depend on?
- If that process stopped tomorrow, who owns getting it back?
- If somebody guessed your password tonight, what would they have by morning?

### Three documents do the heavy lifting

From there, three documents do most of the work, and all of them get built from conversations, so a competent owner can knock out a usable version in about a hundred days of asking questions. The templates below are free to re-use and customize.

1. [Business Process Catalog](https://drive.proton.me/urls/EE82Y1609C#yMbrqTgQ2u58): Lists what makes the company money, ordered by revenue contribution per hour.
2. [Business Systems Inventory](https://drive.proton.me/urls/WX6J4G3J18#433XPCYsHNLt)**:** Maps the systems each of those processes depends on, from the CRM to the backup server room.
3. [Component Ledger](https://drive.proton.me/urls/H7PYXX9CFR#MD0LCZrlEntR)**:** Records who is responsible for each piece, including vendors and contractors.

That’s more risk visibility than Order Express, OneTouchPoint, or ACCC ever had.

And if you need more help, [book thirty minutes with me](https://calendar.proton.me/bookings#qL4TjjAGdaFuaqJv5pNriytK2-rH9U3DhUMQlEIr4ko=) and we can talk it over.