&gt; How do we solve that problem?<p>You don&#x27;t solve it, but you mitigate it.<p>1. Decentralize authentication and get rid of passwords. Persona&#x2F;BrowserID had the exact right idea in mind and .. well, whatever, it&#x27;s gone now, and we&#x27;re all pissed off; plenty was said about it. We need the concept back and we need it to be popular.<p>2. Stop gathering so much data. Stop keeping it for so long. If your client&#x27;s data is sensitive, ask yourself - and your client - whether you should really be keeping it and how long should you be keeping it for. You&#x27;re not Google, Facebook or anything close to them - the odds are you will <i>not</i> be able to do anything with &quot;big data&quot;. Either make the data public in the first place (if it&#x27;s appropriate for it to be public), or wipe it out if you don&#x27;t need it.<p>3. Start treating security malpractice in large companies as seriously as we treat Food &amp; Health standards. Leaking hundreds of thousands of passwords because you hashed them with md5 no salt is <i>criminal</i>.<p>4. Build a better framework for users to learn the basics of security. How it works, why it matters; the fundamentals necessary to figure things out on your own. Make them understand what they&#x27;re giving up if they are not treating this seriously. Education, education, education.