Somewhere in America this week, a hospital scheduler opened her email, clicked a link that looked exactly like her payroll portal, and handed a stranger the keys to a system holding the medical records of thousands of patients.
That is the part that keeps security researchers up at night.
The breach itself is not remarkable anymore, and that is precisely the problem.
What used to be a once-a-year headline has become a monthly annoyance, then a weekly one, then background noise we scroll past on the way to a video of a dog on a skateboard.
The numbers have grown so large that they stop meaning anything.
The human brain cannot hold that many strangers, so we file it under "not my problem" and move on.
But it is your problem, and it is arriving in your mailbox and your phone.
When a retailer or a health network gets hit, the stolen data does not sit still.
It gets packaged, sold, resold, and eventually sprayed across the internet like seed.
Your email address, your old passwords, your mother's maiden name, the last four of a card you canceled three years ago — all of it becomes raw material for someone building a profile of you.
The gadget on your wrist and the phone in your pocket are part of the story too.
Every fitness tracker syncing sleep data, every smart doorbell uploading clips, every app asking for "just a bit more" access is another door in a house that already has too many.
We bought convenience by the truckload and paid for it with visibility.
Companies promise encryption and then quietly deprioritize the security team when quarterly earnings get tight.
The breach is rarely a genius hacker in a basement.
More often it is a tired company that decided your data was cheaper to lose than to protect.
What should unsettle you is not the scale.
We now treat identity theft the way our grandparents treated a car that wouldn't start — an irritation, a phone call, a wait on hold.
We have built an entire emotional immune system around being violated, and that immune system is doing us no favors.
It teaches the next company that the penalty for losing your life's records is a press release and a free year of credit monitoring, which is a coupon, not a consequence.
The fix is not a single app or a password manager, though those help.
We need to stop treating data security as a personal responsibility problem and start treating it as a corporate accountability problem, because a society that shrugs at every breach is a society that will keep getting breached.
Your grandmother's medical history should not be a rounding error on someone's risk assessment.
So update your passwords, turn on the annoying two-factor prompts you keep dismissing, and freeze your credit if you haven't.
But also stop letting the companies off the hook.
Final Thoughts
It is a choice, made over and over, by people who bet you wouldn't care.