An Auckland ransomware case and three years of Spark disclosures reveal how little the headline numbers can tell…