The Long Tail of Data Breaches

The Data That Wouldn't Die

In October 2026, a federal judge granted final approval to AT&T's $177 million class action settlement. It resolves lawsuits over two breaches AT&T disclosed in 2024. The oldest of the exposed data dates back to 2019. The story of how that data traveled from AT&T's systems to a court-approved payout seven years later shows something most organizations misunderstand about breach economics.

The larger breach surfaced in stages. In 2021, the hacking group ShinyHunters claimed to have data on about 70 million AT&T customers, and AT&T denied it came from its systems. In March 2024, a full dataset appeared on a hacking forum. On March 30, 2024, AT&T confirmed the data affected about 7.6 million current and 65.4 million former account holders. It said the data appeared to be from 2019 or earlier.

The dataset included names, addresses, phone numbers, dates of birth and Social Security numbers. It also held encrypted account passcodes. TechCrunch told AT&T those passcodes were easy to decipher, and AT&T reset passcodes for millions of current customers.

The second breach was different. In July 2024, AT&T disclosed that an attacker had copied 2022 call and text records for nearly all of its wireless customers from its workspace on the Snowflake cloud platform. The class settlement splits the money into $149 million for the first breach and $28 million for the second.

Keep a third AT&T incident separate, because it is easy to blend in. In September 2024, AT&T agreed to a $13 million FCC settlement over a January 2023 breach at a vendor. That breach affected about 8.9 million wireless customers. The FCC found the vendor still held customer data that should have been deleted years earlier. AT&T said it included no Social Security numbers.

Put together, the pattern is clear. Data AT&T held in 2019 was offered for sale in 2021, dumped in 2024 and settled in court in 2026. Protection that looked adequate when the data was stored, like weakly encrypted passcodes, did not hold up over time. A vendor kept data it no longer needed, and that data was later stolen.

This is the long tail of data breaches. The incident doesn't end when you patch the vulnerability or file the breach notification. It continues for years as stolen data circulates, gets combined with other datasets and becomes more dangerous over time.

The Breach Lifecycle

Most organizations think of a breach as an event, a point in time when data is stolen. In practice, a breach is a process that unfolds over years. The four phases below are my model of that process.

Phase 1: Initial Compromise (Months 0-3)

The data is stolen. It may be taken in bulk or siphoned slowly over weeks. The organization may or may not notice. IBM's Cost of a Data Breach Report 2026 found organizations took an average of 247 days to identify and contain a breach. That is eight months from intrusion to containment.

Phase 2: First-Sale Market (Months 3-12)

The stolen data reaches criminal marketplaces. Fresh, complete datasets command the highest prices. Prices vary widely by market and change often, so this table shows relative value rather than dollar figures.

Data Type	Relative Value per Record	Why
Complete identity (SSN + DOB + address)	High	Enables new-account and tax fraud
Healthcare records	High	Long-lived, enables insurance and prescription fraud
Bank account credentials	High	Direct path to money
Credit card with CVV	Medium	Useful only until the card is reissued
Corporate email credentials	Medium	Entry point for business email compromise
Social media accounts	Low	Valuable mainly in bulk or for high-follower accounts

The first buyer is typically a group that specializes in cashing out: identity fraud, financial theft or targeted attacks.

Phase 3: Data Aggregation (Months 12-36)

This is where the danger grows. Stolen data gets combined with data from other breaches. A name and email from one breach is merged with an SSN from another and a phone number from a third. These merged profiles are worth far more than any single dataset.

Criminal data brokers match records across many breach datasets using shared identifiers such as email addresses, phone numbers, and names combined with other context. The result is a detailed identity profile that enables targeted fraud.

Phase 4: Long-Tail Exploitation (Years 2-10+)

The data stays valuable, and often gains value, for several reasons:

• Weak protection gets broken: Data that seemed protected becomes readable as cracking techniques and hardware improve, as with AT&T's easily deciphered passcodes
• Legal consequences compound: Class actions, regulator actions and state attorney general cases take years to resolve
• Re-identification advances: "Anonymized" data becomes identifiable when combined with new sources
• Victims let their guard down: People change passwords and freeze credit after a breach, but those protections lapse. Two years later, the freeze is lifted, the new password is reused elsewhere, and the stolen data works again

The Disputed Instagram Dataset

In January 2026, a seller on a dark web forum offered a dataset said to cover about 17 million Instagram users. Malwarebytes reported that the records included:

• Account handles and real names
• Account identifiers
• Email addresses
• Phone numbers
• Country and rough location information

Passwords were not included. At about the same time, many Instagram users received password reset emails they had not requested.

Instagram said it had fixed an issue that let an external party request password reset emails for some people. It said there was no breach of its systems, and it denied that the reset emails were related to the dataset. Malwarebytes said the data may be a compilation that includes older alleged Instagram leaks. The true origin of the dataset remains unconfirmed.

The Scraping vs. Breach Distinction

The Instagram case sits in a growing gray area. If data was scraped through an API, or compiled from older leaks, is it a breach?

Regulators increasingly treat mass scraping as a security failure. In November 2022, Ireland's Data Protection Commission fined Meta €265 million after design failures allowed the scraping of about 533 million Facebook users' phone numbers and personal details. Meta has appealed, and the fine is listed as pending appeal. The Tech Fines entry tracks its status.

For any organization running APIs, the lesson is direct. Rate limiting, authentication and anomaly detection on APIs are not optional. If an automated tool can pull millions of records from your API, you have a security problem, even if each record is "public." Regulators can hold you accountable for it.

The Real-World Impact

Aggregated datasets like this are raw material for attacks. Combined with data from earlier LinkedIn and Facebook scraping incidents, they can be used to:

• Write convincing spear-phishing emails that reference a victim's real interests, location and connections
• Run business email compromise (BEC) attacks against accounts that handle money
• Launch credential stuffing using email and password pairs from other breaches
• Target account recovery flows with matched email addresses and phone numbers

The wave of unrequested reset emails shows the last risk. Attackers who hold a matched email and phone number can probe recovery flows, and victims trained to expect reset emails become easier to phish.

TikTok's Trust Problem: A 150% Uninstall Spike

In late January 2026, US uninstalls of TikTok spiked. Sensor Tower data reported by CNBC showed the daily average of US users deleting the app rose nearly 150% over five days. The comparison was against the previous three months.

The spike followed the January 22, 2026 announcement of TikTok USDS Joint Venture LLC, a majority American-owned entity created to avoid a US ban. Users were also asked to accept updated terms and a privacy policy. Usage did not collapse, though. Sensor Tower said US activity stayed relatively flat compared with the previous week.

The Compounding Trust Problem

The spike makes more sense as the latest step in a long trust story:

2020: Apple's iOS 14 clipboard notification showed TikTok reading clipboard contents, along with many other apps.

2022: BuzzFeed News reported leaked audio from internal TikTok meetings indicating that US user data had been accessed from China, contradicting earlier public assurances.

2023: Montana passed a law banning TikTok in the state. A federal judge blocked it before it took effect. Ireland's Data Protection Commission fined TikTok €345 million over children's default settings, a fine TikTok is appealing.

2024: The Protecting Americans from Foreign Adversary Controlled Applications Act became law, requiring ByteDance to divest TikTok's US business or face a ban.

2025: The Irish DPC fined TikTok €530 million over transfers of European users' data to China. TikTok is challenging the fine in court.

January 2026: The joint venture is formed, a new privacy policy prompt appears, and uninstalls spike.

What the Spike Does and Doesn't Show

The uninstall numbers show how quickly users react when trust is already thin. They don't show a mass exodus, since active use held steady. That nuance matters. Trust damage usually shows up first as a twitchy user base and only later, if at all, as lost revenue.

For any organization that collects user data, TikTok's trajectory is instructive. Users rarely react to a single incident. They react to a pattern, where each new revelation confirms earlier suspicions and reduces the benefit of the doubt.

This table is my model of how trust erodes, not measured data:

Trust Event	User Response	Recovery Difficulty
First incident	Concern, media coverage, minimal behavior change	Low: "everyone makes mistakes"
Second incident	Skepticism, some users adjust privacy settings	Moderate: a pattern begins to emerge
Third incident	Active distrust, privacy-conscious users leave	High: the narrative is established
Fourth+ incidents	Regulatory intervention, uninstall spikes on each new trigger	Very high: rebuilding trust takes years

Data Decay vs. Data Appreciation

One of the most dangerous misconceptions in data security is that stolen data loses value over time. Often the opposite is true.

Data That Decays

Some stolen data does lose value:

• Session tokens and temporary credentials: Expire within hours or days
• Credit card numbers: Useful until the card is reported and reissued
• Short-lived API keys: Rotate on schedules from hours to months
• One-time passwords: Useless after a single use window

Data That Appreciates

Other data becomes more valuable over time:

• Social Security numbers: In practice they never change, so they are useful for identity fraud indefinitely
• Medical records: Permanent, and more useful as healthcare fraud techniques mature
• Biometric data: Cannot be changed. Fingerprints, face geometry and voice patterns are permanent identifiers
• Personal history and relationships: Useful for social engineering long after collection
• Email addresses: Stable identifiers that persist for years, useful for linking accounts across platforms
• Education and employment history: Enables targeted social engineering and credential fraud

The Aggregation Multiplier

The biggest driver of appreciation is aggregation. Individual data points may be worth little. Combined across breaches, they become far more dangerous than the sum of their parts.

Consider this illustrative example:

• Breach A (2020): Email address and hashed password leaked from a retail site
• Breach B (2022): Same email address and phone number leaked from a social media platform
• Breach C (2023): Phone number and home address leaked from a food delivery service
• Breach D (2024): Home address and SSN leaked from an insurance company

No single breach exposed enough for identity theft. Together, a criminal has email, password (cracked from the hash), phone number, home address and SSN. That is a complete identity package, assembled from four breaches over four years, none of which seemed catastrophic alone.

That's why "we only leaked email addresses" is never an adequate response to a breach. Those addresses will be matched with data from other breaches to build profiles that enable real harm.

The Financial Timeline of a Breach

Organizations consistently underestimate how long a breach keeps costing money. The ranges below are my planning estimates for a large organization, not figures from a survey:

Time Period	Cost Category	Planning Range
Month 1-3	Incident response, forensics, initial remediation	$500K to $5M
Month 3-6	System rebuilding, security upgrades, customer notification	$1M to $10M
Month 6-12	Regulatory investigations begin, legal defense preparation	$500K to $3M
Year 1-2	Class action lawsuits filed, regulatory penalties assessed	$2M to $50M
Year 2-3	Settlements negotiated, ongoing legal costs	$5M to $100M
Year 3-5	Insurance premium increases, ongoing monitoring obligations	$1M to $10M
Year 5-7	Residual legal costs, ongoing breach monitoring for affected individuals	$500K to $5M

AT&T's timeline ran from data dated 2019 or earlier to a final settlement approval in 2026. The $177 million covers only the class action. Separate regulatory matters, such as the $13 million FCC settlement over the vendor breach, and AT&T's own remediation costs sit on top.

Lessons for CISOs

1. Plan for Data Longevity

When you assess breach risk, don't judge data by its value today. Judge it by its value in five years, after it has been aggregated with other breaches and cracking hardware has improved.

This means:

• Protection choices must last: Strong, current encryption such as AES-256 with well-managed keys holds up. Short secrets like four-digit passcodes or nine-digit SSNs fall quickly to brute force when they are only hashed. Choose methods that will hold for decades
• Data minimization is your best protection: Data you don't collect can't be breached. Challenge every collection practice. Do you need Social Security numbers? Do you need to keep data for seven years?
• Tokenization over encryption for identifiers: Where possible, use tokenization for sensitive identifiers. A random token has no mathematical relationship to the original value, so it can't be reversed by computing power alone

2. Treat API Scraping as a Security Event

The Instagram dataset and the Meta scraping fine show that API abuse can be a data breach by another name. Make sure your program includes:

• Rate limiting on all APIs, especially those returning user data
• Anomaly detection for unusual API access patterns
• Authentication requirements for bulk data access
• Regular API security assessments
• Monitoring for your organization's data appearing in scraped datasets

3. Make Vendors Delete What They No Longer Need

AT&T's FCC settlement turned on a vendor that kept customer data years after it should have been deleted. Put deletion deadlines in vendor contracts. Then verify deletion, rather than accepting a checkbox on an annual questionnaire.

4. Model Your Aggregation Exposure

Map the data you hold against known breach datasets. If your customers' email addresses already appear in other breaches, your data becomes more valuable to attackers, because it completes their profiles. Services like Have I Been Pwned offer APIs that help you assess this exposure.

5. Build for Regulatory Endurance

AT&T's class settlement came about seven years after the oldest exposed data. Your legal and compliance posture needs to survive that timeline. This means:

• Preserving all incident response documentation for the life of any litigation or investigation
• Keeping relationships with outside counsel who specialize in breach litigation
• Budgeting for multi-year legal defense costs in breach response planning
• Carrying cyber insurance with adequate limits and multi-year coverage terms

The Uncomfortable Truth

Every organization that has been breached, and many that haven't yet discovered it, carries a long-running financial and legal liability. Data stolen from your systems in 2022 is still out there. It is being aggregated, matched and weaponized. The regulatory consequences may not have arrived yet. The class action attorneys may not have finished filing.

The long tail of a data breach is measured in years and, for large companies, in hundreds of millions of dollars. The organizations that understand this invest differently. They invest in data minimization, strong encryption and breach preparedness that spans years rather than months. They treat data as a liability as much as an asset.

Data stolen today will still be causing damage in 2033. The question is whether you'll be ready for that, or whether you'll be the next organization writing a nine-figure check for data you thought was protected seven years earlier.