Early in 2026, a crypto and fintech firm admitted that hackers walked off with the order data of tens of thousands of its customers. Not just email addresses. Names. Home addresses. Purchase histories. The exact details you’d need to knock on someone’s door and pretend to be their delivery driver.

Everyone in tech shrugged. Another breach. We get one every week. But I want to talk about the person who does not read tech news, because that breach lands on her hardest.

Picture a retired schoolteacher who bought a little crypto because her nephew told her to. She used a real name and a real address, because that is what the law requires for these platforms. She has no idea her data is now sitting on a forum being sold for the price of a coffee. She will find out when the phone calls start. Someone who knows her full name, knows she owns crypto, and knows where she lives, calling to “help secure her account.” That is not a random robocall. That is a targeted attack, and it works because the data is real.

Here is the part that should make you angry. She cannot undo it. You can change a leaked password in thirty seconds. You cannot change your home address, your legal name, or the fact that you once bought Bitcoin. The damage is permanent, and she never agreed to carry it.

The counterargument: breaches happen, companies pay fines, life goes on. True. But fines land on the company. The consequences land on the customer. Equifax paid $700 million in 2019 for leaking 147 million people’s data, and not one of those 147 million people got their Social Security number back.

So here is my point. We keep treating data breaches as corporate embarrassments measured in dollars and stock dips. They are not. They are a permanent transfer of risk from a company that got hacked to a grandmother who did nothing wrong. Until the fine matches the lifetime of harm, companies will keep collecting your address and losing it, and calling it the cost of doing business.