A large insurance-sector disclosure shows how a single intrusion into back-office systems can turn durable identity data into a long-tail security problem.