> How common an occurence is that? How often is an unimportant, middle class person's data at risk, really? My online accounts have been compromised 16 times i

> How common an occurence is that? How often is an unimportant, middle class person's data at risk, really? My online accounts have been compromised 16 times in the past 5 years, according to https://haveibeenpwned.com/ https://haveibeenpwned.com/ including sites like Android Forums and Linux Mint Forums. There are plenty of other better known platforms on there, too, so it's safe to assume that most of the data on said sites would have also been accessible to the attackers. In contrast, my current self-hosted software accounts have been compromised 0 times in the past 4 years. Maybe 1 time, if you count a throwaway node's Docker socket being exposed to the network accidentally and a crypto miner getting launched on it. Why is that? Because although many of the online platforms have dedicated security specialists (hopefully) and manage to fight off thousands (or more) attacks daily, all it takes is one good attack to compromise thousands (or more) users and their data in one large batch. Furthermore, those are far more of an interesting target to attackers, possibly due to financial incentives. Unless easily automatable (like the aforementioned Docker crypto attack), attacking self-hosted software is far less lucrative. It would probably be far easier to hack John Doe's Nextcloud or ownCloud instance, yet the financial gain from that would likely be far lower than stealing a bunch of different users' data on a lesser known and less secure cloud platform of some sort, and selling it or doing something else. To that end, i see two strategies for protecting one's data: A) make your defenses good enough to be able to stand up to targeted attacks, which is truly feasible in large orgs and cloud platforms B) make yourself a less lucrative target, by self-hosting some software and making hacking you sufficiently hard, so that most automated attacks will fail (use key pairs for SSH, use fail2ban, SSL/TLS with something like Let's Encrypt, use Docker Networks if you need Docker so that nothing apart from 80/443 of your ingress is actually exposed to the outside / or just use your firewall for the services that are not containerized, though then you also need to think more about user permissions etc.) Oh, and use 2FA where possible (especially in regards to the online services) and use something like https://keepass.info/ https://keepass.info/ for managing passwords - to have them be sufficiently long and different for every site or platform that you use. As for your Google question, i cannot say. They have a pretty decent security track record, however there have been plenty of breaches in large orgs: https://informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/ https://informationisbeautiful.net/visualizations/worlds-big...