The email arrived on a Tuesday, polite and bland, the way bad news usually does now.
A company I had given my Social Security number to years ago was writing to inform me that "an unauthorized party" had accessed "certain files." My name was in there.
Possibly my address, my date of birth, the digits that follow me through every loan application and tax form for the rest of my life.
I read it standing in my kitchen, sighed, and went back to making dinner.
That reaction — the sigh, not the panic — is the real story.
The notifications pile up like junk mail.
A hospital system, a payroll processor, a mobile carrier, a chain of sandwich shops — it hardly matters who this week.
The template is always the same: "We take your privacy seriously." A year of free credit monitoring, offered with the enthusiasm of someone returning a borrowed ladder.
Then nothing changes, because the breach wasn't the failure.
The failure was treating a Social Security number as a password that can never be changed.
The gadgets sitting on your nightstand are part of the problem, and so are we.
A smart speaker that listens for a wake word, a doorbell camera uploading clips to a server, a fitness tracker logging your heart rate at 3 a.m. — each one is a small convenience traded for a permanent record.
We bought them because they were cheap and delightful.
We rarely asked where the data went, because asking felt paranoid, and the checkout button was right there.
Security researchers keep finding the same pattern.
Companies collect far more than they need, store it far longer than they should, and secure it with the enthusiasm of a landlord fixing a leaky faucet.
When the inevitable happens, the cost lands on you.
You spend an afternoon resetting passwords.
The company issues a statement and, occasionally, a new logo.
What makes this a societal problem rather than an IT problem is the asymmetry.
The people whose data leaked bear the risk for decades.
The people who leaked it bear a few bad headlines and a dip in the stock that recovers by the next earnings call.
There is no meaningful penalty for carelessness, so carelessness continues.
It's boring, structural stuff we keep avoiding: laws that force companies to pay real money when they lose your data, a national standard for digital identity that doesn't rely on a nine-digit number you can't change, and a cultural shift where "we take your privacy seriously" is treated as the punchline it is.
Until then, expect more emails, more sighs, and more of your life living in someone else's leaky basement.
But don't let the calm of routine fool you into thinking this is normal.
Final Thoughts
A country that shrugs at every breach is a country that has quietly agreed to be burglarized on schedule.