I've been part of four or five breaches. My favorite part is the complete lack of value in the mitigations for me. I was part of the OPM data breach, and the

I've been part of four or five breaches. My favorite part is the complete lack of value in the mitigations for me. I was part of the OPM data breach, and the data included was literally everything, since it was everything collected as part of my application for a security clearance. A result of that was 10 years of credit monitoring, so every new breach's offer of 12 or 24 months of monitoring is useless. Until there are statutory damages for data breaches, and even steeper ones for failure to report breaches, companies aren't going to properly safeguard data.