Twenty years ago, I argued that creating databases of sensitive information -- including home addresses, biometric data, and Social Security numbers -- should be understood as ultra-hazardous activities. They could be managed only if the entities creating them were held fully liable for breaches. As AI models generate new and extreme risks, a strict-liability regime is urgently needed.