I typically hard link the file, that gives you the option to rename/move/organize as you see fit. If you need to reencode or splice that breaks the link, but for just organization it works great.

I’m assuming since it’s showed up on Have I Been Pwned the other day, which may mean the compromised data’s (or at least a portion of it) has been found

knowing there’s just big hands inside their flippers is unsettling

Google Pay will do the same thing so you should be good there. It’s called credit card tokenization.