Loading: Personal data still the vector for account takeover attacks