For regular users the risk is largely from the services they're using being compromised. If you upload your data to some cloud service and it gets hacked, then your data ends up pwned too.