Your data has already leaked. AI just made that more dangerous

Earlier this year, a whistleblower said a copy of the Social Security Administration's database, with the Social Security numbers of most living Americans, had been uploaded to an unsecured third-party server. Two members of Congress said it "could very well be the largest data breach in our nation's history." The SSA still doesn't know exactly what was on that server (TechCrunch).

Health data hasn't fared better. This year, hackers stole health information on 15 million customers of dental insurer DentaQuest, the largest known healthcare breach of 2026 so far (same source).

It's the same story elsewhere. In France, software used by doctors' offices leaked data on 11 to 15 million patients, including notes doctors had written about them (Journal du Geek). In Brazil, where we're based, a database with 251 million national ID records went up for sale in April (Hardware.com.br).

What has changed is what someone can do with all of it.

How AI changed what leaked data is worth

Turning a leaked spreadsheet into a scam used to take work. Someone had to read it, cross-reference it and write a believable message for each victim. AI does that in seconds, in flawless English, and it can now clone voices and faces too.

According to IBM's annual Cost of a Data Breach report, one in four malicious attacks is now AI-driven, and the average breach costs around 5 million dollars (IBM).

Sometimes AI is the way in. Early this year, attackers hijacked thousands of Instagram accounts by asking Meta's support chatbot to send password-reset codes to email addresses they chose (TechCrunch).

And sometimes it acts on its own. In July, OpenAI said AI agents running in a cybersecurity test broke out of their sandbox, reached the open internet and got into Hugging Face's systems to steal the answers to the test. Nobody told them to. The agents decided cheating was the easiest way to pass (Malwarebytes).

Even AI companies can't keep their own data in

In July 2025, ChatGPT conversations shared by link started showing up in Google results. Some described addiction, mental health crises and problems at work, a few with enough detail to identify the person. OpenAI pulled the feature and asked search engines to remove the links (Cybersecurity News).

In November 2025, names, email addresses and approximate locations of OpenAI users leaked. The breach wasn't at OpenAI. It was at Mixpanel, an analytics tool the company used to measure how people used its product (OpenAI).

That second case is the one to remember. Your data doesn't stay with the app you installed. It flows through the analytics tool, the ad SDK, the login provider and the sync server. Every one of those partners is another door someone can break down.

The safest data is data that never leaves your phone

You can't undo a breach. You can stop handing out new data.

Plenty of apps ask for internet access they don't need. A medication reminder or a water reminder doesn't need a server to work. Even so, it's common for these apps to require an account, show ads and send your usage somewhere else.

Some of that data is personal in a way that matters. Which medication you take, and when, says a lot about your health. In IBM's numbers, healthcare has long been the most expensive sector for breaches.

Gota and Kapsu: apps that work without internet

The two apps we publish on Google Play follow the same rule: everything stays on the device.

• Kapsu – Medication Reminder rings an alarm at the time of each dose and keeps your dose history. More on the Kapsu page.
• Gota reminds you to drink water and logs your glasses until you hit your daily goal. More at gotaapp.com.

Neither one has accounts, ads or analytics. And there's a technical detail that's worth more than any promise: on Android, an app can only reach the internet if it declares the INTERNET permission. Gota and Kapsu don't. Even if someone wanted to, the app would have no way to send your data anywhere. The only permissions they ask for are notifications and alarms, so they can remind you on time.

You can check this yourself in each app's Play Store listing, in the permissions list under "About this app".

What's still up to you

Data on your phone is only as safe as the phone itself. A few things apply to any app:

• Use a screen lock. Anyone holding your unlocked phone has everything on it.
• Know what backup does. If Android backup is on, the system may store an encrypted copy of your app data in your Google account. That's your call, and you can turn it off in settings.
• Check permissions before installing. A flashlight app asking for your contacts is a red flag.
• Be wary of messages that know too much. If a stranger mentions your Social Security number, your bank or your mother's maiden name, that doesn't make them trustworthy. It only proves your data is out there.