The only way not to lose a user's private data via a hack is by not having the private data in the first place. There's no other way.