At least it appears to be something that gets triggered. In theory, if a node is not under attack or heavy usage, this isn’t a consideration. Doesn’t seem to be a perfect solution as it still slows the traffic of legitimate users in the event of an attack. I don’t know the full details, but in the worse case it makes it easier to semi-DoS, maybe not by fully making a node unresponsive, but by making the service so painfully slow that users may give up on it.

Definitely this. The data is not likely gone, but before doing anything that could make things worse, try and get a full copy of the SD card somewhere. From there you may safely try repairing the partition or data carving tools.

Accounting details, sensitive credentials for sys admin use, HIPAA data, PII etc. there’s just so much crap understood to be temporarily unlocked, viewed, and then immediately deleted or locked again. Even home users shouldn’t turn this thing on, check your bank? Balance and account details now always available. Use a password manager? Whatever you looked at is likely captured.

Yay… Capitalism…

Compounded by sites like RSSing that frame or scrape other websites. Another hit, but literally the same thing verbatim as another.