Hello. Despite the conventional wisdom about data minimization, businesses continue to over-save information.

Companies commonly collect more data than they need and hold onto it for too long. When hackers strike, they can get away with troves, often resulting in a breach bigger and more expensive than it had to be.

In a hack last year at Nova Scotia Power, attackers stole the personal information of about 375,000 current customers and many more former customers—around 540,000, according to Canada’s privacy commissioner, which investigated the incident. Social Insurance Numbers, which the utility used to verify customer identities, were among the compromised sensitive data.

After a consumer uproar, Nova Scotia Power extended its credit monitoring offer from two years to five years for all current and former customers, even if they weren’t affected by the breach. It also agreed to reform data practices, deleting all Social Insurance Numbers from its databases, with exceptions for special legal or tax reasons.

More news:

• Grand Theft Auto maker confirms new breach
• Get ready for bugmageddon, thanks to AI
• Booking.com says reservations data was compromised
• Goldman Sachs CEO says cyber is at the core of his business
• And more

Night club operator RCI Hospitality Holdings said Monday it is investigating a potential data breach after discovering a cyberattack in March. Hackers accessed a web portal used by RCI's independent contractors and run by the company's internet services unit, according to a regulatory filing.

Travel site Booking.com is notifying an unspecified number of customers that their reservation details were compromised after the company noticed suspicious activity in its tech systems. (The Register)

Healthcare breaches continue. Rocky Mountain Associated Physicians, a weight-loss facility based in Salt Lake City, Utah, said 50,640 patients had their personal, medical and in some instances financial information exposed in an October 2025 cyberattack. 

• Legend Senior Living, an elder-care provider with sites in eight states, is notifying at least 5,000 patients and families of a similarly wide-ranging breach. A hacker accessed its systems between July 27, 2025 and August 15, 2025, the company said.

The WSJ Pro Cybersecurity team is Deputy Bureau Chief Kim S. Nash and reporters Angus Loten and James Rundle. Follow us on X @WSJCyber. Reach the team by replying to any newsletter you receive or by emailing Kim at kim.nash@wsj.com.