Cybersecurity Is No Longer Just an IT Problem: What Happens When Personal Data Escapes?

Cybersecurity is the practice of protecting systems, networks, devices and information from unauthorized access, disruption, alteration or destruction. Personal data deserves special attention because it can act as a key to a person’s finances, healthcare, employment and identity. Names, dates of birth, government identifiers, medical records, financial details and biometric information can all be used to identify or trace someone.

This is why public trust in digital government and commerce depends so heavily on privacy and security. The danger is not limited to embarrassing disclosure. Stolen information can support fraudulent credit or utility accounts, tax-refund theft, unauthorized medical care or impersonation.

Two cases show how severe the consequences can become. In the 2017 Equifax breach, approximately 147 million people were affected; the exposed information included names, dates of birth, Social Security numbers and payment-card data. That created a large-scale identity-theft risk, and Equifax agreed to a settlement of at least $575 million.

The Change Healthcare ransomware attack in February 2024 illustrates a different kind of damage. Healthcare and billing systems were disrupted across the United States, creating problems for providers and patients and posing a direct threat to continuity of care. GAO later reported estimated losses of about $874 million and said more than 110 million Americans may have been affected; those figures are reported estimates, not necessarily final totals.

Individuals should recognize and report phishing, use unique passwords or a password manager, enable multifactor authentication and install updates promptly. But personal caution cannot compensate for organizations collecting huge databases and failing to protect them. How much responsibility should fall on companies, platforms and public institutions—and how much on the individual?

The individual-security checklist is sensible, but it is also the part companies love because it shifts the burden onto the least powerful party. MFA does not repair an organization that stores more sensitive data than it needs, exposes an old system or gives a third party excessive access.

Also, “the data was encrypted” is not a complete security argument. Availability matters too. Change Healthcare shows that a system can fail catastrophically even when the immediate harm is not a public database dump. Healthcare payment infrastructure is effectively critical infrastructure, whether the org chart admits it or not.

I agree with the principle, but “collect less data” is not a product strategy by itself. Businesses need enough information to provide regulated services, prevent fraud and support customers. The real question is whether they can explain why each field exists, limit access and delete it when the purpose ends.

My unpopular view: mandatory MFA for high-risk accounts is reasonable, but forcing every low-risk interaction through a terrible authentication flow will push ordinary users toward unsafe workarounds. Security that people routinely bypass is a failed interface.

That is a false choice, softsignal. Good MFA does not require a terrible flow, and account risk is often invisible to the user. The account that looks “low-risk” today may contain recovery details, payment access or identity documents tomorrow.

The more important distinction is between authentication and authorization. MFA can reduce credential abuse, but it does not stop an already-authorized employee, vendor or compromised service from reaching an oversized database. Threat models need to include those paths, not just phishing headlines.

The incentives are upside down. The company receives the convenience and commercial value of collecting data; the individual usually receives the long-term administrative mess when that data is exposed. A settlement years later is not the same thing as restoring a person’s identity history.

Stronger penalties might help, but only if they change behavior before the breach. Otherwise they become another predictable business expense. I would rather see liability tied to unnecessary collection, poor retention practices and failure to implement basic controls than a blanket punishment for every incident, including genuinely unforeseeable ones.