~/incidents $ tail -f casualties.log // scrollback exhausted. the log writes faster than you can read.
THE FALLOUT
the last few years, itemized · every warning label came true · nobody was ready
[01] THE ERA
Sometime around 2020 the hypotheticals stopped being hypothetical. Every warning label the paranoids had been printing for thirty years came true, at once, in production.
The pattern used to require imagination. "What if your DNA leaked?" was a thought experiment. "What if the wiretap system got hacked?" was a slippery slope. "What if your car reported you to your insurer?" was a joke about the future. Between 2022 and 2025 every one of those shipped, and the postmortems all read the same: the data was collected for one purpose, retained past any purpose, and then did what stored data does.
The dragnet also went retail. It used to take an agency or a trillion-dollar platform to surveil you at scale. Now it takes a license-plate camera subscription, a data broker with your SSN, and a bankruptcy judge. The infrastructure the corporations built to sell you things turned out to be a loaded weapon left on the table, and the last few years are the record of who picked it up.
This page is the casualty list. Not the full one, the full one doesn't fit, just the entries that prove the shape of the thing.
// the casualty count
| 1.3B+ | breach victim notices sent in the US in 2024 alone (ITRC) |
| 258 days | average time to find and contain a breach (IBM, 2024) |
| 190M | Americans in the Change Healthcare ransomware hit. one company |
| $305M | what 23andMe's genetic database fetched in bankruptcy court |
| ~25 yrs | age of the "we take your privacy seriously" press template |
| 0 | breached companies that responded by collecting less |
// the apology is a form letter. the dataset is forever.
[02] THE CASUALTIES
The day abortion law changed, period trackers, location pings near clinics, and search histories became evidence. In Nebraska, Facebook handed over a mother and daughter's private messages under warrant and both were convicted. "Nothing to hide" has an expiry date, and it's whenever the law changes under you.
A single flaw in a file-transfer tool most victims had never heard of cascaded through 2,700+ organizations and tens of millions of people: pension funds, universities, government agencies. Your data lives in supply chains you didn't choose and can't audit, and it fails all at once.
Credential stuffing exposed ~6.9 million profiles, with lists of users with Ashkenazi Jewish and Chinese ancestry packaged for sale on forums. Then the company went bankrupt in 2025 and the DNA database itself went on the auction block for $305M. You can change a password. You cannot change a genome, yours or your relatives'.
AT&T lost the call and text metadata of "nearly all" its wireless customers through a third-party cloud account. National Public Data, a broker most of its victims never heard of, leaked hundreds of millions of SSNs and then declared bankruptcy. Metadata is the stuff they kill people based on, and it was sitting in someone else's bucket.
GM piped driver telemetry from millions of cars to LexisNexis and Verisk without meaningful consent, insurers read the printout, and premiums went up. The drivers found out from a reporter. Lawsuits and an FTC ban followed, after the data was already sold.
Chinese intelligence was found living inside US telecoms, including the CALEA systems built to give law enforcement wiretap access. The mandated backdoor worked exactly as designed, for the wrong government, against presidential campaigns. A door built for good guys is a door.
Microsoft shipped an OS feature that screenshots everything you do, every few seconds, into a local database. Security researchers dismantled it within days, it was pulled, reworked, and shipped anyway. The most-deployed operating system on earth now offers perfect recall of your screen, to whoever ends up holding the machine.
The EU kept reintroducing Chat Control to scan private messages. The UK switched on age verification, identity papers for the internet's flimsiest websites. And the UK secretly ordered a backdoor into iCloud's encrypted backups; Apple's answer was to pull end-to-end encryption from the UK entirely. The tools still work, which is exactly why the bills keep coming.
$ ./opt-out --of everything > clearview: face already scraped. billions on file. > flock: plate already logged at 14 intersections today. > broker_47: profile sold while this command was running. // opt-out applies to future you. past you is inventory. // the only winning move was never being in the dataset.
[03] THE PATTERN
None of these were freak accidents. Every single one was a stockpile behaving like a stockpile.
Run the list again and watch the mechanism repeat. Collected data leaks: 23andMe, MOVEit, AT&T, National Public Data. Retained data gets sold: GM's telemetry, the broker economy, a genome database liquidated like office furniture. Mandated backdoors get used by the wrong people: Salt Typhoon didn't break CALEA, it logged into it. And data collected under one legal regime gets prosecuted under the next: the Nebraska messages were innocuous when they were sent. Different victims, different industries, one law of nature. A database is a promise that someone, someday, will use it against the people in it.
This is the watcher-decides argument with the theory removed and the body count attached. You don't get to pick who ends up holding the stockpile: the breach picks, the bankruptcy court picks, the next election picks, the acquisition picks. The only variable you control is whether the data exists. Uncollected data is the only data that has never leaked, never been subpoenaed, never been auctioned, and never been occupied by somebody else's intelligence service.
The trendline is not flattening. AI made every old dataset newly valuable, the broker economy made every dataset newly liquid, and the legislative wave keeps trying to outlaw the one countermeasure that works. The window where opting out is cheap is open right now and visibly closing.
// the breach was not an anomaly. the breach was the data reaching its natural state.
[04] VERDICT
This page will get longer. Your exposure doesn't have to.
The casualty list grows on its own schedule, but your entry in it is optional. Every system you stop feeding tonight is a breach that can't include you in 2027. The math is grim and the fix is boring: understand why the right matters, switch the tools that leak for the ones that don't, and copy a stack that's already been argued over. For the money side, cash that doesn't keep a ledger of you exists. None of it requires permission, a law, or anyone's apology letter.
// the next entry on this list is being collected right now. don't be in it.