Why You Can't Really Delete Your Information After a Data Breach

Cybersecurity expert Troy Hunt used a colorful comparison in his weekly update to describe a frustrating reality about data breaches. Once your personal information leaks online, trying to remove it is like trying to remove urine from a swimming pool. It spreads everywhere and cannot truly be undone. This matters because companies often promise they have fixed a breach or secured your data after an attack, but the stolen information remains out there. This affects anyone whose information has ever been exposed in a data breach. If your email, password, phone number, or other personal details were stolen in any past hack, that information is likely still circulating among criminals and on the dark web.

Even when a company announces they have remediated the problem and secured their systems, your already stolen data stays compromised.

Here is what you should do right now. First, visit haveibeenpwned.com and enter your email address to see which breaches have exposed your information. Second, change your passwords on any accounts that were breached, and make sure each account has a unique password. Third, enable two factor authentication on every account that offers it, especially email, banking, and social media. This adds a second security step beyond just your password. Fourth, use a password manager to create and store strong, unique passwords for every account. Accept that data breaches are a permanent part of online life now. Your defense is not preventing your information from ever being exposed, but making sure a breach on one site cannot compromise your other accounts.

This is why unique passwords and two factor authentication matter so much. They limit the damage when the inevitable breach happens.