Data breaches can haunt victims for years after they happen