The Bad Guys Already Know Everything About You
If they haven't tried to steal from you yet, it's only because they haven't gotten around to you.
Think about it: Every ecommerce site you’ve ever bought from has your name, physical address, contact information, and order history on file. If a website has particularly bad backend security, it might even have your credit card information in unencrypted plaintext. It shouldn’t, but “shouldn’t” doesn’t mean “doesn’t” as often as it should.
But reputable ecommerce sites are trustworthy, right? It’s not like you’re ordering from sketchy sites, and legitimate businesses aren’t going to do anything too nefarious with that information. Right?
The problem is that data breaches exposing user data are terrifyingly common. Searching for your email address at haveibeenpwned.com will tell you if your data has already been leaked, and, spoiler alert, it probably has. Don’t feel bad; mine has too. Breached sites over the years include Facebook (533 million records exposed in 2021), SoundCloud (29.8 million records exposed in a 2025 breach), and Yahoo (a staggering 3 billion records). Discord recently leaked personal information on 70,000 users, and Harvard University saw donor and alumni records breached by threat actors in late 2025.
Perhaps most frightening of all, a breach of National Public Data in 2024 exposed approximately 2.9 billion records, including names, addresses, and Social Security numbers.
None of this leaked data is hard to find if you know where to look. Yes, I know where to find it. No, I’m not going to tell you. I’m not here to make the bad guys’ job any easier.
The point is, your data has probably been exposed in multiple breaches already. Threat actors already have access to your name, address, phone number, purchase histories, and passwords (you’re not reusing passwords, right?). There’s a very good chance they have your Social Security number, which allows them to commit identity theft.
If it hasn’t happened already, it’s only because they haven’t gotten to you yet. 3 billion records is a lot to get through. But they’re systematic. They’ll find your needle in the haystack eventually. It’s just a matter of time. You need to be prepared.
We’ve discussed in this newsletter before how to protect yourself from password breaches. We’ve talked about the importance of multi-factor authentication. But how do you protect yourself if your Social Security number has already been leaked?
First and most important: Freeze your credit. If you’re in the U.S., the three main credit bureaus are Equifax, Experian, and TransUnion. All three have procedures for freezing your credit for free. Do it now, before you forget. Then, when you apply for a new credit card or a loan, you’ll take a moment to unfreeze it before they do a credit check, and then re-freeze it when they’re done. Annoying? A little bit. But it’s better than having fraudulent loans taken out in your name and leaving you holding the bag.
If you’re not in the U.S., your country likely has its own credit reporting agencies with similar procedures for freezing your credit.
Second: Lock your Social Security number. This can be done by calling the Social Security Administration at 1-800-772-1213 and asking to block electronic access to your Social Security records. This prevents anyone—including you—from accessing or changing your Social Security record online or via automated phone systems until you remove the block. Again, you’ll need to unlock your SSN before applying for a job or other legitimate activities that require a third party to view your records. It’s mildly annoying, but it’s better than identity theft.
Finally, stay vigilant. Monitor your financial accounts and credit score regularly. Financial institutions and credit bureaus offer tools to keep you updated and alert you to suspicious activity, often for free.
Like many things at the personal level of cybersecurity, the picture looks bleak when it first comes into focus. But it’s not a message of doom and gloom. Hopelessness is the wrong takeaway. Our goal here is to understand the threats and then prepare for them before we’re confronted by them.
We are not defenseless. Be prepared, stay safe, and have fun.