The casting call is already going out. Lapsus$ posted Mercor on its leak site on April 4 with 4 terabytes of contractor onboarding data, and somebody is going to play the security leader who walks out of HR with a banker's box. It is the same casting call that goes out after every breach worth naming. The CEO and CFO never read for that part.
More than 40,000 people recorded voice prompts, sat for webcam selfies, and uploaded a passport or driver's license to do AI training labeling work for Mercor. All of it sat bundled in one row of one database, then walked out by an extortion crew. Off-the-shelf voice cloning needs fifteen seconds of clean audio to produce a usable forgery. Mercor's recordings reportedly average two to five minutes per contractor.
Identity does not rotate. Passwords do. Voices, faces, and government-issued IDs do not. The legal recourse framework for biometric harm is empty. The underground market for paired voice-and-ID records is not. 40,000 people are now materially harmed, forever, by a breach the executive layer of one company chose to make possible.
The boxes the budget built
The CIO and CISO can only work in the boxes they are forced to live in. The CEO and CFO build the boxes.
Every breach worth a press release runs on the same spine. When the CISO is not up to the task, you can trace the failure back to a CEO who didn't know how to hire, and to a CFO who didn't want to pay for a real one. When the CISO is up to the task and gets handed an inadequate budget, you can trace the failure to a CEO and CFO who said "no, it's not worth the dollars," or "no, we can't impact production," or "no, that sounds too hard."
The technical leader does not make those decisions. The technical leader inherits them. Then, when the boxes the budget built fail to contain the threat, the technical leader is the one whose name shows up in the press release.
The pattern, three flavors
The slow walk-out. Equifax, 2017. 143 to 147 million records, including the full set of inputs Equifax used to verify your identity. CEO Richard Smith "retired" with roughly $90 million in pension, equity, and benefits. CIO David Webb and CSO Susan Mauldin were forced out within weeks, no comparable parachute disclosed. No jail. No board bar. Nothing structural changed at the company.
The chronic abuser. T-Mobile, 2018 to today. Seven plus breaches. 76.6 million records in 2021. 37 million in 2023. CEO Mike Sievert led through the entire breach run and was promoted to Vice Chairman in November 2025. T-Mobile didn't list a security chief on its public leadership page until the FCC mandated, as part of the $31.5 million settlement, that the CISO report directly to the board. The structural fix was imposed by a regulator, after the harm.
The architectural malpractice. Target (2013) and Home Depot (2014). Both were a network segmentation failure a junior engineer could have caught, because the third-party vendor's credentials should never have lived on the same network as the point-of-sale system. Target's Gregg Steinhafel walked with $15.9 million in severance, $13 million in final-year pay, and a $1.5 million advisory salary on the way out. CIO Beth Jacob resigned first, severance not publicly disclosed. Home Depot's Frank Blake had already announced retirement before the breach was disclosed and walked clean. There was no officer-level CISO to fire because the role didn't exist. The FTC settlement had to require Home Depot to create the position.
The pattern across all of them is three beats. Every CEO walked with eight or nine figures. Every technical leader was out the door faster, with smaller or undisclosed packages. Every fix that mattered was imposed by a regulator after the harm, not by the executives who controlled the budget before it.
Why nobody wants to face it
It happens because nobody wants to face the truth. The chief executive and the chief financial head drive these decisions, and they cause this 100% of the time. The technical leader is the easiest face for the press release because the executive layer benefits from the profit, the executive layer chose the risk, and the executive layer feels none of the impact when the harm lands. The asymmetry is the feature, not the bug.
Class action will not fix it. You have to prove actual damages in real dollars, and biometric harm doesn't trace in a straight line. Stolen identity-verification data is a Sword of Damocles, but courts want quantifiable injury. The harm shows up in someone's life two or four or six years later as a fraudulent wire transfer, an unauthorized credit application, or a synthetic-voice call to an aging parent. Good luck linking that back to the row in the Mercor archive.
The fix has to come from somewhere with the standing to reach the people who decided the risk.
The directed action
TO CONGRESS: Pass a federal data breach liability statute that names the CEO and CFO personally for breaches of biometric and identity-verification data. No corporate-veil shelter. Bars from officer and director roles for repeat or willful failure. Make the lever big enough that the budget conversation changes the next morning.
TO STATE ATTORNEYS GENERAL: Use the consumer protection authority you already have. Letitia James used it to land the New York piece of the Equifax settlement. Use it to stack personal liability claims against the executives who signed the budgets that built the boxes. Don't wait for Congress.
TO THE SEC: Expand the SolarWinds CISO indictment theory upward. If a CISO can be charged for misleading disclosures, the CEO and CFO who signed the same 10-K can be charged for misleading the budget the CISO had to live inside. The 10-K signers are the budget signers. Treat them like it.
What's worth protecting
The data Mercor lost is worth protecting. AI training data is the input layer of the entire generation of enterprise AI services every reader of this post is buying or building. Voice biometrics, government IDs, and webcam selfies are the inputs to a fraud kit that scales for the price of API calls. The supply chain that produces this data deserves real CISO authority, real budget, and real governance. None of that is going to happen until the people who decide what the budget looks like are personally on the hook for what the budget makes possible.
40,000 people are materially harmed, forever. Until the people who profit feel the impact, security dies, millions get damaged, and the next 40,000 are already in the queue. Pick the lever that makes them feel it.