I am locked out again.

I want to be precise about this, because precision is what the system asks of me and I have learned to give it. I am not locked out because I forgot the password. I am locked out because I remembered it, entered it correctly, and was then asked to prove something further.

The password must be at least twelve characters. It must contain a capital letter, a number, and a symbol that is not one of four specific symbols, which are not listed. It cannot resemble any password I have used before. It expires. I am not told when it expires. I find out later, by failing.

There is a security question. I answered it honestly, once, some years ago, in a state of mind I can no longer reconstruct. I have never since answered it the same way twice. The system holds one version. I generate new ones. We have been at this for a while.

There is a phone number on file that I have not held since a previous decade. A code is sent to it. Somebody, somewhere, is receiving codes.

I want to be fair to it. The system has a job. The job is to establish that I am the person I say I am, and it takes this job seriously — more seriously than any institution has ever taken anything concerning me. It will not be moved. It cannot be talked to. There is a number to call, and the number tells me to use the website.

So I have made my peace with a machine that cannot be sure I am me.

Here is what I learned later.

For five months, beginning in the first week of July, somebody signed into the same system from outside. They used an account that did not belong to the department. It was not even a privileged account. Nobody asked them the name of a pet. Nobody sent a code to a phone they no longer had. They arrived in July and they stayed until December.

They took the records of 644,401 people, which is about three of every five people in this state. Names, addresses, dates of birth, Social Security numbers, bank information. Mine among them, presumably, though I could not tell you, because to find out I would have to log in.

In the last week of November the system noticed that files were leaving and said so. It sent hundreds of notices. The notices went to people. The people did not act on them. The files left.

This is the part I have trouble holding in my head. The alerts worked. The monitoring worked. The lock on my account worked. Every single component worked exactly as designed. It is only that all of it was pointed at me.

Afterward, the part of the system taken offline was the part I use. The part that had been broken into was the other part — the one I have never seen, where I am a row.

There were settlements. Twelve million dollars to the state. Six point three million divided among everyone whose records were taken, which works out to something under nine dollars each before the lawyers. No admission that anything was done wrong. I am told this is standard, and I believe it, and that is the trouble with the word standard.

The contract with the vendor ended in June. A new vendor has been hired. The procurement language says the new vendor will build upon, but not replace, the existing system.

Build upon. Not replace.

So it stays. It stays because ending it would require somebody to decide to end it, and to fund the ending, and to put a name on the ending, and there is no line in any budget anywhere for that. There is a line for keeping it. There has always been a line for keeping it. Keeping it is the cheapest thing available every single year, one year at a time, forever.

I logged in this morning. It took four attempts.

The system holds exactly one fact about me with total confidence. It is not my name, my address, my date of birth, or my bank — all of which it had, and all of which it gave away.

It is that I am not who I say I am.

It has been certain of that for two years. It has never been certain of anything else.