There are nude photos of me on the internet.
I am a naturist. Somewhere on a beach website, in a club newsletter, in a stranger's holiday album, there is me: unfiltered, unretouched, entirely unremarkable. As far as I know, nobody has ever found them. Nobody has ever gone looking. On an internet that serves more free nudity per second than a human being could consume in a lifetime, one more naked Dutchman on a beach is not a scandal. It is a rounding error.
The damage of a naked picture was never in the picture anyway. It is in the context. A stolen photo of a woman, passed around among her colleagues, is devastating: for her, in that office, among the people who know her name. The rest of the internet shrugs. The actress Bella Thorne understood this better than most. When a hacker threatened her with her own stolen nudes in June 2019, she simply published them herself and took away the only thing he had: the power to decide when.
My passport number is also on the internet. That one, I did not put there.
One grain in the silo
In February, Odido, my telecom provider here in the Netherlands, was hacked by a criminal outfit called ShinyHunters. Odido put the damage at 6.2 million accounts; the hackers, never shy, claimed eight million. The same crew has hit Ticketmaster and others before. Taken this time: names, addresses, phone numbers, bank account numbers, dates of birth, and the numbers of passports and driving licences. When Odido refused to pay a ransom of over a million euros, the data went up on the dark web, a million rows a day, like a drip-fed serial.
I got the email. I read it. I did nothing.
Not out of laziness. There was simply nothing to do. I cannot change my date of birth. I cannot rotate my passport number like a password. The official advice was to stay alert for suspicious calls and messages, which is roughly what you tell someone whose front door has been carried off: keep an eye on the hallway.
And here is the uncomfortable truth: I don't feel a thing. My data has been stolen more times than I can count, and I have never once noticed. Or at least, never noticed anything I could trace back to a specific breach. That is not denial. It is arithmetic. I am one record among millions, as interchangeable as a grain of wheat in a silo. Nobody asks which grain. If a fraudster ever does pick my number from the pile, it will be a well-informed phone call eight months from now, and I will never know it came from Odido. The harm, when it comes, arrives without a return address.
Call it data deflation. The more of it is stolen, the less any single piece of it seems to be worth. Least of all to me.
The deflation even has a price tag. When the American data broker National Public Data went bankrupt in 2024 after losing an estimated 270 million Social Security numbers, its own filing valued that stolen database at one million dollars. Do the sum: less than half a cent per number. Your entire identity, as a line item, is worth less than the stamp on the letter telling you it was stolen.
Your entire identity, as a line item, is worth less than the stamp on the letter telling you it was stolen.
Worthless to everyone, guarded by no one
This is where the deflation stops being merely interesting and starts being the problem.
My single record is worthless to me, because I can do nothing with it. But it is equally worthless to Odido. What matters to them is the silo, not the grain. And nobody spends money guarding something they don't value. You don't throw it away either. You just forget it is there, like the boxes in the attic, until a burglar sends you the inventory.
That is, almost literally, what happened. Odido's own CEO later admitted to the NOS, the Dutch public broadcaster, that the company's internal investigation, on the day of the hack, concluded nothing had been stolen. They found out otherwise two days later, when the thieves told them. Then it emerged that former customers who had left five or even ten years ago were in the dump too, while Odido's own privacy statement promised to keep their data no longer than two years. Among the loot were internal notes on whether customers kept up their payments or had a court-appointed administrator. Nobody asked for those to exist, either.
And when the bill does come, the hoarder can simply leave the table. National Public Data told the bankruptcy court its insurer had declined coverage and that it held less than 75,000 dollars in assets. A few months later it shut down for good. Hundreds of millions of Americans kept their compromised Social Security numbers. The company kept nothing, because it had nothing to lose.
So the deflation runs both ways. To me, my data is too common to worry about. To the company holding it, it is too cheap to protect.
Prescribed risk
I never asked anyone to keep my passport number. I was told to hand it over.
My own government is quite clear on this. Its official advice is never to hand over your ID just like that, and it even built an app, KopieID, so you can black out your citizen service number and stamp a watermark on the copy. A telecom company, the same government says, may copy your ID but must mask the photo and the number.
And yet. Try renting a flat, signing up for an energy contract or getting a phone subscription without uploading a full scan. The government warns you; the company makes it a condition. Call it prescribed risk: the company decides you must perform a dangerous act, stores the result carelessly, and when it all goes wrong, you get an email with tips.
Sometimes the risk is not prescribed by a company but by law. To comply with the UK's new age-verification rules, Discord asked users who disputed an automated age check to send in a photo of their passport or driving licence. In October 2025 it emerged that attackers had got into a third-party customer-support provider and walked off with ID images of around 70,000 users. The hackers claimed over two million. Parliament decided you must prove your age. A support contractor kept the proof. A criminal now owns it. Nobody in that chain asked whether the scan needed to exist at all.
The tips are the best part. Odido was not breached by some genius with a quantum computer. According to the NOS, the attackers phished the login details of customer-service staff, then phoned them pretending to be Odido's own IT department and talked them into approving the login. The company that fell for a phone call now advises me to be careful who I talk to on the phone.
They collect. We clean up.
The average of my silo
So far, this has been a story about companies. But the grain-in-the-silo logic does not stay in the server room. Somewhere along the way, people quietly turned into data, and data is treated the way data is treated.
Here is the paradox that should keep us up at night. As a grain, I am interchangeable in value: one record, half a cent. But I am not interchangeable in findability. Any grain can be picked out of the silo in a second, the moment somebody wants it. Anonymous enough to be ignored, identifiable enough to be found. I don't count, but I can always be located.
In his 2004 book The Digital Person, the legal scholar Daniel Solove argued that we picked the wrong nightmare. The fitting metaphor is not Orwell's Big Brother but Kafka's The Trial: not someone watching your every move, but faceless bureaucracies deciding about you on the basis of a dossier you never get to see. Add twenty years of algorithms and the dossier is not even about you anymore. You are judged as the average of the people who look like you on paper.
This is not science fiction. Australia ran it for four years. Between 2015 and 2019, its Robodebt scheme raised some 1.73 billion Australian dollars in unlawful debts against more than 400,000 people, by taking their annual income and spreading it evenly across the year, as if anyone on welfare earns the same every fortnight. People received bills for an average they had never been. The Royal Commission later called it a "crude and cruel mechanism".
My own country did it with a nationality checkbox. In the Dutch childcare benefits scandal, a tax-office risk model counted dual nationality as a fraud indicator, and some 26,000 families were wrongly branded as cheats. Many lost their homes and jobs. The government resigned over it in 2021. The data protection authority fined the tax office 2.75 million euros, noting along the way that the nationality data should have been deleted years earlier. The same old story: kept because nobody bothered to throw it away, then used because it was there.
And the big states? China mostly collects in-house: cameras, police facial recognition, DNA databases in Xinjiang. (The all-seeing "social credit score" so beloved of Western headlines is largely a myth; researchers describe a patchwork of blacklists rather than one number per citizen. The cameras, however, are real.) The United States, more elegantly, buys. A declassified US intelligence report from 2023 confirmed that agencies purchase commercially available data on Americans, including phone location data, and that the government believes it can track phones without a warrant as long as it pays for the privilege. Different political systems, same accounting: citizens as datasets, the one collected in-house, the other outsourced.
That is where deflation ends. First your data stops being worth anything to you. Then you stop being anything more than your data.
First your data stops being worth anything to you. Then you stop being anything more than your data.
The cloakroom
When you hand your coat to a cloakroom, you get a ticket. If the coat disappears, nobody tells you that you should have kept a closer eye on it. When a bank is robbed, your savings don't vanish with the robbers; the vault was the bank's problem. Only with data have we turned this on its head. They hold the vault. We get the email.
Australia once came close to handing out a cloakroom ticket. In 2022 the telecom company Optus lost the data of up to 9.8 million current and former customers, 2.8 million of them with passport or licence numbers. The federal government blamed lax security and told Optus to pay for its customers' replacement passports and driving licences. It was a rare moment of a government sending the bill to the party that held the vault. Even then, some states would only issue a new licence number once you could show fraud had already happened. Proof of the harm first, then the lock.
So here is the thesis, plainly: whoever collects my data owns the risk. Not me.
This is not even radical. It is more or less what the GDPR already says. The organisation processing personal data is responsible for securing it, and may only collect and keep what it actually needs. The rule exists. It just doesn't hurt anyone. The fines, if they come, come years later. The harm to customers is untraceable by design. So a leak costs the company a press release and costs me something I will never be able to prove.
The objections are predictable, so let's get them out of the way.
Perfect security does not exist. True. But what you don't store can't leak. Why does a phone company keep a former customer's passport number for a decade?
The company is a victim of criminals too. So is a robbed bank. We still expect it to have a vault, and to lock it.
Shouldn't people use strong passwords? By all means. But I cannot make my date of birth stronger. For the data that does the most damage, I have no button to press at all.
If deflation is the disease, the cure is to reverse it, not for the hacker but for the hoarder. Make every record expensive to lose. Make the one who insisted on keeping it pay when it walks. Watch how quickly companies discover they never needed that passport scan in the first place.
Weather and climate
These days, news of a data breach lands like the weather forecast. Rain again. Annoying, unremarkable, forgotten by lunch. But whoever only watches the weather misses that the climate is changing. One leak is weather. All the leaks together are climate: a permanent, growing, cross-referenced copy of all of us, sitting on servers nobody controls.
I have no secrets left worth leaking. My body is on a beach website, and nobody cares. What I do have is a passport number, an address and a date of birth, stored by companies I never asked to keep them, guarded by staff who approve logins for strangers on the phone.
My data has become worthless. The problem is that the companies keeping it agree.