TL;DR: Data Privacy Week 2026 runs January 26-30. The theme is "Take control of your data." In 2025, Verizon counted 12,195 confirmed data breaches. Researchers found 16 billion leaked credentials floating around. The average breach costs $4.44 million globally, $10.22 million in the US. Healthcare got hit hardest. The Change Healthcare breach alone exposed 190 million Americans. "Take control" sounds nice, but companies keep losing your data anyway.
Data Privacy Week started today. The official theme: "Take control of your data."[1]
That would be easier if companies stopped leaking it.
The Numbers Are Brutal
2025 was the worst year on record for data breaches. Verizon's 2025 Data Breach Investigations Report found 12,195 confirmed breaches across 139 countries, the most they've ever tracked.[2]
The highlights:
- 16 billion credentials compiled from infostealer malware and previous breaches[3]
- 165.7 million records exposed in H1 2025 alone (US only)
- 190 million Americans affected by the Change Healthcare ransomware attack, more than half the country[4]
- Cyberattacks every 39 seconds worldwide
- 30% increase in global cyberattacks year-over-year
The average data breach costs $4.44 million globally. In the US, it's $10.22 million, up 9% from last year.[2]
Healthcare remains the most breached industry. The average healthcare breach costs $7.42 million.
Why "Take Control" Is Complicated
The official Data Privacy Week message asks you to think before sharing data: "Is the service, app, or game worth the amount or type of personal data they want in return?"[1]
Good question. But here's the problem: companies collect data whether you consent or not. They share it with partners. Those partners get breached. Your data ends up on a dark web forum.
You can lock down your settings. You can use unique passwords. You can enable two-factor authentication on everything. And your doctor's office can still lose your records to ransomware.
That's not "taking control." That's damage mitigation.
What Actually Works
The pessimism aside, there are steps that genuinely reduce your risk:
Password Managers
Use one. Every account gets a unique 12+ character password. When one site gets breached, your other accounts stay safe. Bitwarden is free and open-source.
MFA Everywhere
Multi-factor authentication stops 99.9% of automated attacks. Use authenticator apps (not SMS, since SIM swapping is real). Turn it on for email first.
Reduce Your Footprint
Delete accounts you don't use. Each old account is a breach waiting to happen. That MySpace account from 2006? Gone. The shopping site you used once? Gone.
Data Broker Opt-Outs
Your info is being sold. Use California's DELETE Act (DROP) portal if you're a CA resident. Otherwise, manual opt-outs work.
The "Core 4" From Cybersecurity Experts
The National Cybersecurity Alliance pushes four basics:[1]
- Long, unique passwords: 12+ characters, different for every account
- Multi-factor authentication: Stops credential stuffing cold
- Automatic updates: Patches close vulnerabilities before attackers exploit them
- Phishing awareness: Learn to spot fake emails, texts, and DMs
These aren't revolutionary. They're table stakes. But most people still don't do them.
Check Your Exposure
Google yourself. See what comes up.
Check Have I Been Pwned for your email addresses. If they've been in breaches (they probably have), change those passwords immediately.
Review your browser privacy settings. Most modern browsers block third-party cookies by default now. Use a privacy-focused search engine like DuckDuckGo or Brave Search.
What Companies Should Do (But Won't)
Here's what would actually fix the problem:
- Data minimization: Stop collecting data you don't need
- Encryption at rest: Encrypt everything, not just in transit
- Zero-trust architecture: Assume every system is compromised
- Faster disclosure: Tell people immediately when you're breached
The average breach takes 241 days to detect and contain.[2] That's eight months of your data floating around before anyone knows.
But companies won't change until regulations force them. GDPR fines have hit €6.7 billion total. Still not enough to move the needle.
California's New Tool
California launched the DELETE Act's DROP platform on January 1, 2026. One form, one submission, and every registered data broker in the state must delete your info.[5]
It's the first tool of its kind. If you're a California resident, use it. If you're not, push your state for something similar.
The Bigger Picture
Data Privacy Week is about awareness. That matters. But awareness without systemic change just shifts blame to individuals.
You didn't choose to have your Social Security number stored on a hospital server. You didn't ask for your purchase history to be sold to data brokers. You didn't consent to having your face scanned at a grocery store.
The real "taking control" would be federal privacy legislation that limits what companies can collect. The US still doesn't have one. Europe has GDPR. Brazil has LGPD. India has DPDP. America has a patchwork of state laws and corporate promises.
Until that changes, "take control" means playing defense in a game rigged against you.
Happy Data Privacy Week.