> Your data being accessible as part of a breach does not entitle you to damages if nothing actually happens to you. Why not? This seems like an incredibly unn

> Your data being accessible as part of a breach does not entitle you to damages if nothing actually happens to you. Why not? This seems like an incredibly unnecessary and near impossible burden on me if anything actually did happen. Let's say five years down the line my identity is stolen and somehow, magically, we know it is because someone had access to my SSN. If my SSN was exposed in two or three different breaches, how do I prove anything?