A story about a person who didn’t think twice — and the invisible machine that did.
Terry didn’t think he had anything to hide.
Terry was a 34-year-old bank manager in Atlanta. Busy, tech-savvy enough to feel confident, and just like everyone else unbothered by those cookie consent banners. He used mostly the same password everywhere, his dog’s name, and his Instagram was public because why not. Location and contacts shared freely across apps and totally fine with personalized ads.
He was, in his own words, just like everyone else not giving a damn about privacy — it’s out there anyway right?
Then, in the span of about eighteen months, his life turned upside down — and the data spilled out.
He Googled about himself one afternoon and found his home address, estimated salary, relatives’ names and cell phone numbers on sites he’d never heard of. A complete stranger could buy his full profile for just $9.99.
The data had been assembled by a company called National Public Data — a background-check firm he’d never interacted with, never consented to, and never even known existed. In 2024, that company was breached. A criminal group exfiltrated records on an estimated 2.9 billion Americans and put the database up for sale on the dark web. Names, Social Security numbers, addresses, family relationships — all of it, packaged and priced. Terry was in there. So were you, in all likelihood.
He applied for a new job — a role he was overqualified for — and was offered $22,000 below the posted range. HR mentioned they had “benchmarked his background.” He later learned that salary history and income estimates are routinely purchased from data brokers to anchor compensation offers. He took the pay cut.
Then, in the fall, calls started coming in about an apartment in Omaha. Someone had rented a one-bedroom unit under his name and Social Security number, signed a 12-month lease, and stopped paying in month three.
The eviction and the debt — nearly $8,400 — hit his credit report before he even knew the apartment existed. Fixing it took eleven months, two attorneys, and more paperwork than he’d handled in his entire adult life.
Terry was critical of a certain government, posting on social media and attending protests. On a trip to a country, with a complicated relationship with free speech, his location was being monitored through certain apps. He was detained and questioned after 6 hours in custody. Though he was released he wasn’t sure what they did to his phone.*
Terry wasn’t unusually careless. He just hadn’t understood that every app, every public post, every reused password was a puzzle piece — and that the puzzle was being assembled, sold, and acted upon, continuously, by people and systems he’d never consented to deal with.
THE MACHINE BEHIND IT
What happened to Terry wasn’t bad luck. It was the predictable output of several overlapping industries that have quietly built a surveillance economy around ordinary behavior. Here’s how each one works.
WHAT YOU CAN ACTUALLY DO
None of this requires becoming a hermit or building a Faraday cage in your basement. Most of the following is free, takes less than an afternoon, and reduces your exposure disproportionately.
Terry eventually got most of his credit history restored. He now uses Proton Pass for unique passwords, ProtonMail for anything sensitive, Apple or Proton’s ‘hide my email’ on shopping websites, and Proton VPN when he’s on mobile. He’s frozen his credit at all three bureaus and deleted 140 apps he hadn’t opened in a year. He still uses Instagram. He just made it private.
None of this matters until it’s a problem, the challenge is that AI will supercharge these attack vectors. The good news is that AI tools can help you counter some of these issues (separate topic) — just don’t be Terry.
*Terry’s story is a composite, but each element of it has been documented in real cases — by Human Rights Watch, the DOJ, and congressional testimony.