Security or Advertising? Why Tech Companies Still Get Hacked

Every technology company says that security and privacy are top priorities. Then hackers take every scrap of information available, and the company announces an investigation, offers a year of credit monitoring and promises to do better. The pattern repeats so often that it raises a fair question: if it is so secure, why does it keep getting hacked? The answer lies partly in technology and partly in incentives. This article explains why breaches continue in 2026 and how to protect yourself regardless of what companies promise.

1. The pattern of promises and breaches

Large breaches have become a regular feature of the news. Equifax exposed data on about 147 million people in 2017, and a 2019 settlement included up to $700 million. Capital One’s 2019 breach affected roughly 100 million people in the United States and about 6 million in Canada, resulting in an $80 million fine from the Office of the Comptroller of the Currency in 2020 and a $190 million class settlement. Facebook paid a $5 billion penalty to the Federal Trade Commission in 2019 over privacy violations, and Meta later agreed to a $725 million class settlement in 2022. Optus and Medibank in Australia were breached in 2022. Read about these events at the 3 biggest data breaches and Equifax data breach.

In 2025, the FBI’s Internet Crime Complaint Center logged 67,456 personal data breach complaints with $1.31 billion in losses. See ic3.gov.

2. Why breaches keep happening

Data is valuable. Personal data can be sold, used for fraud and leveraged for extortion. Attackers have a strong financial motive.

Large attack surface. Modern companies run cloud services, partner integrations, mobile apps and legacy systems. A single misconfiguration or unpatched flaw can expose data.

Human error and phishing. Employees click links or reuse passwords. Attackers target them because it works.

Third-party risk. Vendors with access to data can be the weak link.

Security versus growth. Security spending and friction compete with feature launches and revenue. Under pressure, security can lose.

Data hoarding. Companies collect more than they need and keep it indefinitely, which multiplies the harm when a breach occurs.

Weak accountability. Penalties are inconsistent, slow and sometimes small compared with revenue. Our article do big fines prevent data leaks? discusses this.

3. The advertising connection

Many technology companies make most of their money from advertising. Advertising rewards detailed data on users: what they watch, where they go, who they know. That creates an incentive to collect widely and keep data, which is exactly the opposite of what security teams recommend. Data you never collect cannot be stolen. The trade-off is one reason that privacy advocates push for data minimization, and why regulators in some places require companies to collect only what they need.

Moreover, advertising ecosystems share data with many partners. Each partner is another place where it can leak. See Google and Facebook are personal data hoarders and tech giants’ data handling.

Curious what’s already out there? Wiperts’ 100% Free Diagnosis shows which data brokers are listing your name, home address and phone number. Check your exposure free — it takes about a minute.

4. What happens after a breach

Companies usually follow a script: investigate, notify regulators and customers, offer credit monitoring, change passwords and promise improvements. Class actions and regulatory penalties may follow years later. For individuals, the result is often modest compensation or none. Our article an inefficient cycle: how companies respond to data breaches describes why this loop fails consumers.

The real consequences land on you. Leaked data can be used for phishing, account takeover and identity theft long after the news fades; see how long can data leaks affect you.

5. What you can do when companies fail

Share less. If a company never has your birth date or phone number, they cannot be leaked. Provide only what is required.

Use unique passwords and MFA. A breach at one site should not unlock others. Use a password manager and an authenticator app or passkeys.

Separate email addresses. Use one for banking, one for shopping and one for social.

Freeze credit. It is free and prevents most new-account fraud; see IdentityTheft.gov and consumer.ftc.gov.

Watch for phishing. Breached data fuels convincing messages. Verify through official channels.

Delete unused accounts. A smaller footprint is a smaller target.

Remove public listings. If criminals cannot easily match leaked data to your current address and relatives, the data is less useful. Use official opt-outs like spokeo.com/optout and suppression.peopleconnect.us.

Use legal rights. In states with privacy laws, request deletion of data you no longer want companies to hold. California residents can use DROP at privacy.ca.gov/drop.

6. Reading the signals before you trust a company

You cannot audit a company’s security, but you can look for signals. Does it offer MFA and passkeys? Does it explain what it collects and why? Does it make deletion easy? Has it been fined or sued for privacy violations? Does it publish clear breach notifications? The FTC publishes enforcement actions at ftc.gov, and the Consumer Financial Protection Bureau lists complaints at consumerfinance.gov. A company that answers well is not immune, but it is more likely to take security seriously.

7. What a better system would look like

Better security would combine technical and policy changes: data minimization and short retention periods, mandatory strong authentication, rapid breach notification, meaningful penalties, security reviews of vendors and mergers, and limits on the sale of sensitive data. Progress is happening in some places. About twenty US states have comprehensive privacy laws, and registries of data brokers exist in California, Vermont, Texas and Oregon. But the system still places much of the burden on individuals, which is why your own defenses matter.

8. A worked example

Alicia receives a notice that a retailer she used five years ago was breached. She checks the retailer’s official site, changes the password she had reused on two other accounts, adds MFA and freezes her credit. She then deletes the old account, requests data deletion and removes her address and phone from the people-search sites that appear in her search. When a phishing email arrives referring to the old order, she recognizes it and reports it.

9. Myths about breaches

“Big companies are safe.” Size does not prevent breaches. “A year of free monitoring is enough.” Monitoring only alerts you. “If I do nothing, nothing happens.” Leaked data can be used for years. “Fines fix it.” Often they are late and limited.

10. Data minimization: the simplest security control

Security experts often say that the best way to protect data is not to hold it. Data minimization means collecting only what a service needs, keeping it only as long as necessary and deleting it afterward. A retailer that does not store your full card number cannot lose it. A social app that does not retain old location history cannot leak it. When you evaluate a service, favor those that explain retention periods and offer self-service deletion. When you can choose, give the minimum.

11. What regulators are doing

Regulators have increased pressure. The Federal Trade Commission has brought cases against companies that misrepresented their security or privacy practices, and the Consumer Financial Protection Bureau supervises parts of the financial sector. State attorneys general enforce breach notification and privacy laws. In 2024 the FTC issued an order requiring Marriott to build a more rigorous security program after its Starwood breach, and similar orders now routinely require data inventories, retention limits and independent assessments. Read about enforcement at ftc.gov and consumerfinance.gov.

12. Your breach readiness checklist

Keep a list of your important accounts and the email addresses used. Make sure your password manager is up to date and every critical account has MFA. Keep credit freezes in place. Know where to report problems: identitytheft.gov for identity theft, reportfraud.ftc.gov for scams and ic3.gov for internet crime. Save contact information for your bank, your card issuers and your mobile carrier. When a breach is announced, you can then act in minutes rather than days, which often makes the difference between a close call and a costly case.

13. Three scenarios

Scenario 1: You get a breach notice. Verify it on the official site, change passwords and freeze credit.

Scenario 2: Your password appears on a leak list. Change it everywhere it was used and enable MFA.

Scenario 3: A company asks for more data than it needs. Decline, or pick another provider.

14. What to expect: a realistic timeline

Action	Time to do	When it takes effect
Password changes and MFA	1 hour	Immediate
Credit freezes	30 minutes	Immediate
Account deletions	1 to 3 hours	Days to weeks
Broker opt-outs	2 to 4 hours	Days to 4 weeks
Rechecks	15 to 30 minutes	Every 60 to 90 days

15. Common mistakes

Reusing passwords.
Trusting promises over practices.
Ignoring old accounts.
Clicking breach-related emails.
Leaving public listings that help criminals match data.

16. How Wiperts helps limit the damage of breaches

Wiperts scans more than 100 data brokers and people-search sites, submits removal requests, asks Google and Bing to remove personal results, blurs your home on maps and monitors 24/7 so relisted data is removed again. That makes breached data harder to tie to your current address and identity.

Check how easily leaked data could be matched to you.

100% Free Diagnosis: Check Your Exposure

Find out what data brokers have on you. Enter your details in the free scanner on the Wiperts homepage:

First Name
Last Name
Select State
Email Address
Website

Scan Databases Now — no payment is needed to see your exposure report.

17. Key takeaways

Breaches persist because data is valuable, systems are complex and incentives favor collection.
Penalties arrive late; protect yourself with unique passwords, MFA, freezes and less sharing.
Delete unused accounts and remove public listings.
Use your legal rights and watch for phishing.

Pick the Wiperts plan that fits your household

Plan	Covers	One-time deep scrub	Then
Individual	1 person	$89	$14/month
Couples (most popular)	2 people	$149	$24/month
Family	Up to 4 people	$199	$39/month

Every plan includes removal of your name, date of birth, salary, home address and phone number from 100+ data brokers and people-search sites, Google and Bing search-result removal, home blurring on maps, and 24/7 monitoring that re-removes your data if it reappears. See plans and start your removal

18. Frequently Asked Questions

Why do companies keep getting hacked despite promises?

Because they hold large troves of valuable data, run complex systems, depend on third parties, make mistakes and face determined attackers. Security competes with growth and cost goals.

Does advertising increase breach risk?

Business models that rely on collecting and keeping detailed data create bigger targets. The more data stored, the bigger the potential breach.

Do fines stop breaches?

Penalties can motivate improvements, but they often arrive years later and may be small compared with revenue. Strong security requires ongoing investment and data minimization.

What should I do after my data is in a breach?

Change the password, enable MFA, freeze credit, watch accounts and beware of phishing that uses the leaked details.

How can I reduce the damage of future breaches?

Share less, use unique passwords, separate emails, credit freezes and remove public listings that let criminals match leaked data to you.

How big are breach losses?

The IC3 recorded 67,456 personal data breach complaints and $1.31 billion in losses in 2025, and large incidents can affect millions of people.

Sources

Ready to erase your footprint?

Stop letting data brokers profit from your personal life. Start your removal today.

Start Removing