Data security's worst year yet