So if someone takes this data and just keeps the whole dataset exposed publicly on a tor site, is that pretty much the end of data breaches?

Like, some random website: "we just got hacked, all you pii was taken, but don't worry nothing thats not already available in that public database"

other than new credit card #'s it'd be basically pointless right?

The fact that the pii existed is more systemic. We use social security numbers to verify identity and have a unique way of identify people across systems. If our current system of doing this (i.e. SSNs) are no longer reliable we will have to come up with something to replace it. If what we use to replace it is as brittle of a solution we will run into a similar problem down the road.

Well... no.

Everybody on that list will change their CC and life carries on until the next breach.

well ya thats the point, credit card breaches may still happen but those are easy to cancel, but all the PII would be permanently in the public domain.

Which way to the frog sauna?

I have to be honest, I have no idea what you mean. I tried googling "frog sauna" but all I got were advertisements for actual saunas for frogs. Lol ‍️

I think it's an allusion to boiling frogs.

https://en.wikipedia.org/wiki/Boiling_frog