2026 is the New 2016 - Relearning the Lessons from the 'Year of the Data Breach'

The talk opens with the claim that 2026 is starting to look like 2016, a year remembered for a flood of very large data breaches. The speaker, a cybersecurity attorney, sets out current trends: breach counts hit a record last year, much of the growth came from vendor compromises, reused or leaked old credentials, and patches for flaws that were years old. He walks through examples of a ransomware attack on a software vendor that forced many banks to notify customers about a breach they did not suffer themselves, and a French finance ministry incident that began with an old password.

The middle section returns to 2016, when Yahoo, LinkedIn and others disclosed breaches that were either years old or far larger than first reported. He explains how the sector-by-sector federal approach and the patchwork of state notification laws shaped what companies were required to disclose, and why a disclosure that was silent in 2012 would have been mandatory later. He also covers the rise of class actions over smaller breaches, where settlement terms paid victims little while attorney fees were not capped, and how these costs feed into higher insurance premiums.

For practitioners, the closing argument is that generic training does not change behavior, so training should be tailored to job role and paired with a security culture. Password managers need to be explained rather than simply mandated, and organizations need written patch and security policies, since many lack them. The talk ends with six takeaways, and the speaker stresses that people are both the main risk and the main defense.