Liability Without Expiration: Why Old Data Breaches Keep Producing New Victims

At some point in the past decade, your credentials were almost certainly stolen. Not speculatively — statistically. The Identity Theft Resource Center documented more than 3,200 publicly disclosed data compromises in the United States in 2023 alone, and that figure represents only the incidents large enough or visible enough to trigger mandatory disclosure. The actual number of exposures, including those affecting smaller organizations and those that go undetected for extended periods, is substantially higher. If you have maintained email accounts, used retail websites, participated in loyalty programs, or interacted with any of the hundreds of companies that have experienced significant breaches over the past fifteen years, your data is almost certainly circulating in some form.

The standard narrative around data breaches follows a familiar arc: company discovers intrusion, company notifies affected users, users change passwords, life resumes. This arc is dangerously incomplete. It describes the moment of disclosure without accounting for the years — sometimes decades — of downstream harm that a single breach can generate. The breach is not an event. It is the beginning of a process.

Credentials Do Not Expire in Criminal Markets

The underground economy that processes stolen credentials operates on a fundamentally different timeline than the one most users imagine. When a set of email addresses and password hashes is exfiltrated from a compromised database, it enters a distribution chain that may take months or years to fully propagate. Initial buyers are typically sophisticated actors who prioritize the freshest, most valuable records. As those records are used, resold, and consolidated with data from other breaches, they migrate into aggregated datasets — what researchers call "combo lists" — that circulate freely across criminal forums and dark web marketplaces for years after the originating breach.

A 2021 analysis by SpyCloud, a credential monitoring firm, found that the average time between a credential being stolen and its appearance in an active account takeover attack was approximately fifteen months. For breaches that were not publicly disclosed promptly, that window was considerably longer. The practical implication is that a user who changes their password immediately upon receiving a breach notification may have already been exposed to credential-stuffing attacks that occurred before the notification was sent — and may continue to face exposure from the same breach event for years afterward through aggregated datasets they have no visibility into.

This is not a theoretical risk. Court documents from federal prosecutions of credential-stuffing operations have revealed that defendants were actively using breach data from incidents that occurred four, five, and six years prior. The 2012 LinkedIn breach, which exposed approximately 117 million hashed passwords, was not fully weaponized until 2016, when the complete dataset appeared for sale. Users who had changed their LinkedIn passwords in 2012 but reused those credentials elsewhere had four years of false security.

The Reconstruction Problem

Credential reuse is only one vector through which old breaches produce new harm. The more sophisticated threat is identity reconstruction — a process by which adversaries combine data from multiple breach events, each individually incomplete, into a composite profile sufficiently detailed to enable account takeover, synthetic identity fraud, or targeted social engineering.

Consider what a criminal analyst can assemble from three or four mid-tier breaches affecting a single individual: a full name and home address from a retail loyalty program breach; a date of birth and partial Social Security number from a healthcare provider breach; account security questions and answers from a gaming platform breach; and a current email address and phone number from a social media breach. No single breach in this set enables significant fraud on its own. Together, they provide enough raw material to defeat knowledge-based authentication systems, impersonate the victim to financial institutions, and potentially open new lines of credit in the victim's name.

This reconstruction dynamic is what makes the "just change your password" response to breach notifications so inadequate. Passwords are one data point. The other data points — name, address, date of birth, the name of your first pet, the street you grew up on — cannot be changed. Once exfiltrated, they remain accurate indefinitely, and their utility to adversaries does not diminish with time.

Where Regulatory Frameworks Fall Short

United States data breach law is primarily organized around disclosure obligations — requirements that affected organizations notify users and, in some cases, regulators within specified timeframes following discovery of a breach. These frameworks, which vary significantly by state, were designed to ensure that individuals receive timely information that allows them to take protective action. They were not designed to impose ongoing obligations on breached entities commensurate with the ongoing harm their data exposures generate.

The Federal Trade Commission has authority to pursue enforcement actions against companies whose data security practices are deemed unreasonable, and has done so in notable cases. The FTC's 2019 settlement with Facebook and its 2023 action against data broker Kochava represent meaningful exercises of that authority. But FTC enforcement is reactive, resource-constrained, and focused on institutional behavior rather than individual remediation. The gap between a user's ongoing exposure to breach-derived fraud and the regulatory system's capacity to address that exposure is substantial.

The European Union's General Data Protection Regulation takes a somewhat more expansive view of organizational responsibility, including provisions around data minimization and storage limitation that, if enforced aggressively, would reduce the volume of historical data available to be stolen. US privacy law has not adopted comparable minimization requirements at the federal level, though California's Consumer Privacy Act and its successor, the California Privacy Rights Act, represent meaningful steps in that direction for California residents.

What neither framework adequately addresses is the concept of cascading liability — the idea that an organization that experiences a breach should bear some ongoing obligation proportional to the harm that breach continues to generate in subsequent years. The breach is treated as a concluded incident rather than as the originating event in a long chain of foreseeable consequences.

What Vigilance Actually Requires

In the absence of regulatory frameworks that adequately address ongoing breach harm, individual vigilance remains the primary line of defense — an unsatisfying reality that places the burden of institutional failure on the people least responsible for it.

That vigilance, practically speaking, involves several disciplines that extend well beyond password hygiene. Monitoring services such as HaveIBeenPwned, maintained by security researcher Troy Hunt, allow users to check whether their email addresses appear in known breach datasets and to receive notifications when new breaches are indexed. Credit monitoring — ideally through a combination of free annual credit reports from AnnualCreditReport.com and a paid monitoring service with real-time alerting — provides early warning of identity reconstruction attempts that reach the financial system. A security freeze placed with each of the three major credit bureaus (Equifax, Experian, and TransUnion) is currently the most effective tool available to individuals for preventing new account fraud, and it is available at no cost under federal law.

For account security specifically, the use of unique, complex passwords for every account — managed through a reputable password manager — eliminates the credential-stuffing vector that old breaches enable. Hardware security keys or authenticator app-based two-factor authentication adds a layer of protection that credential databases alone cannot defeat.

None of these measures eliminate the underlying problem. They are adaptations to a landscape shaped by institutional failures that individuals cannot correct. The data that was taken from you without adequate protection is still out there. It is still being used. And the organizations that held it bear a responsibility that, under current law, largely expires the moment the notification email is sent.