Breach fatigue is real, but a leak of names, phone numbers and vehicle registrations isn’t low-risk; it’s a potential goldmine for patient criminals.

Threat actors don’t need to break into anyone’s bank account. They can sit on this data for six months, wait until the news cycle dies down and send a simple text claiming someone owes a £9 airport parking overstay fee. It’s low, slow and devastatingly effective. One fake payment page later, criminals could have a fresh set of credit card details with minimal effort and a profitable return.

As individuals whose data is constantly being exposed, we have to ask what threshold of stolen identities it will take for organisations to prioritise basic exposure prevention over reactive apology statements