Client data at major U.S. banks including JPMorgan, Citi, and Morgan Stanley may have been exposed in a cyberattack on mortgage technology vendor SitusAMC, prompting Ethereum co-founder Vitalik Buterin to comment on privacy as a practice of “hygiene.”

The breach stemmed from unauthorized access to systems at SitusAMC, which confirmed Saturday that a threat actor had exfiltrated data tied to several large financial institutions.

Exposed data included “accounting records and legal agreements” as well as “certain data relating to some of our clients’ customers” while the scope, nature, and extent of the breach remain under investigation, the company said.

The breach prompted Buterin to argue that privacy should be treated as basic digital “hygiene” instead of being something optional.

“Privacy is not a feature. Privacy is hygiene,” Buterin said in response to a tweet regarding the incident first reported by the New York Times.

Ethereum and privacy

Buterin’s response points back to a broader argument he has been making this year, where he frames privacy as a baseline requirement for digital systems instead of as an add-on.

In an April essay, he outlined a path for Ethereum to support stealth addresses, selective disclosure, and application-level zero-knowledge tooling, aiming to reduce the kind of structural data exposure seen in both traditional finance and public blockchains.

“Calling privacy ‘hygiene’ is a useful reset,” Shiv Shankar, CEO of Boundless, a decentralised marketplace for zero-knowledge compute, told Decrypt. Shankar added that privacy “should be in the same category as patching servers or rotating keys: routine, non-negotiable, and built into the infrastructure, it should not be a premium feature added on later.”

In October, the Ethereum Foundation launched a new privacy-focused cluster and released initial details about Kohaku, a privacy-centric browser wallet and software development kit developed by Nicolas Consigny and Buterin, who debuted it at EFDevcon in Argentina last week.

Privacy as principle, then as technology

The shift in focus comes as privacy, both as a principle and as a set of technologies built to maintain it, has drawn renewed attention across major chains.

Ethereum is advancing protocol-level tools alongside continued work on new privacy layer-2 chains, Bitcoin is working on Taproot-enabled upgrades and wallet-based approaches, and Solana is consolidating around Light Protocol after the sunset of earlier projects like Elusiv.

“Privacy by default ensures that everyone benefits from strong cryptographic protections automatically, without needing to understand complex tooling or make conscious privacy decisions for each transaction,”  Quinten van Welzen, head of strategy and communications at Zano, a privacy-focused L1 blockchain, told Decrypt.

Attention has also tracked for Zcash, a privacy-focused cryptocurrency designed to let users choose between transparent transactions and fully shielded transactions that hide the sender, receiver, and amount using zero-knowledge proofs. Last week, a Nasdaq-listed treasury firm bought more ZEC, pushing its stock 469% over the past month.

Still, privacy as a principle has been embedded in crypto since its earliest days, especially in the context of its relationship with the traditional financial system.

“Banks must be trusted to hold our money and transfer it electronically, but they lend it out in waves of credit bubbles with barely a fraction in reserve,” Satoshi Nakamoto, the pseudonymous creator of Bitcoin, wrote in 2009. “We have to trust them with our privacy, trust them not to let identity thieves drain our accounts.”