Why is one unparameterised query treated as a critical finding rather than a minor bug — what does a single injection flaw actually cost?

Because the blast radius is the whole table, not one account: the database has no concept of "only this user's rows", so one broken query can hand over every record. The 2012–2017 breach roll-call runs from a single admin account to 145 million people.

* The same flaw class, four orders of magnitude of impact — the scale follows the data behind the query, not the size of the bug. *

Seven headline breaches from that window, listed for scale:

Read the list for scale, not as seven identical post-mortems. Public reporting attributes the vector explicitly to SQL injection in some cases — the UK regulator's TalkTalk fine named an unpatched injection flaw on legacy pages, and the Yahoo credential dump was a UNION-based extraction. Treat the figures as reported rather than adjudicated — TalkTalk's early estimate ran to millions, while the number the regulator ultimately confirmed was about 157,000 customers. For others the initial foothold was different or was never publicly confirmed; Equifax's is attributed to an unpatched Apache Struts vulnerability. What the whole set demonstrates is the consequence of an attacker reaching the data layer.

Two reasons the numbers get so large:

• The query is the only thing standing between a user and the table. Application logic — "show me my orders" — lives entirely in the WHERE clause. Break the clause and that restriction is gone; the database happily returns everything the connection's account is allowed to read, which is usually everything. Note the GoDaddy row: one admin account is a small number and still a total loss, because it converts into everything else.
• Injection is cheap and repeatable. It needs no malware, no insider and no privileged position — just a request. So the same technique scales from a hobby site to a credit bureau at the same cost to the attacker.

The takeaway that generalises past these dates: severity is set by what sits behind the flaw, not by how small the code change is. A missing parameter binding on one endpoint is a one-line bug with a whole-database consequence, which is why the fix — never concatenate, always bind — is treated as non-negotiable rather than a style preference.

Go deeper:

• SQLi Hall-of-Shame (Code Curmudgeon) — a running catalogue of organisations breached by SQL injection.