Robinhood data breach exposes 5M email addresses, personal data

If there are no consistent, firm financial penalties for these companies, they have little incentive to harden their data stores. Every quarter there's another one. Besides corporate penalties, the highly-paid c-suite executives should also be financially penalized. If they don't feel the pain, they can't instill the importance to their teams.

Begging your pardon but you seem to want to punish the victim of a crime here.  If someone breaks into my home is it my fault because I didn’t upgrade my security every month?
The sad truth is just like a house where someone determined enough will break in there is no such thing as invulnerable security.  Computer users are in a no win scenario of fighting a purely defensive war against an enemy operating with complete impunity. That’s an impossible situation.  I think it’s time our government which by charter exists to protect and defend should engage by offering assistance to fortify the vulnerable and aggressively prosecute the perpetrators.

StrangeDays said:

If there are no consistent, firm financial penalties for these companies, they have little incentive to harden their data stores. Every quarter there's another one. Besides corporate penalties, the highly-paid c-suite executives should also be financially penalized. If they don't feel the pain, they can't instill the importance to their teams.

vztrv1 said:

Begging your pardon but you seem to want to punish the victim of a crime here.  If someone breaks into my home is it my fault because I didn’t upgrade my security every month?
The sad truth is just like a house where someone determined enough will break in there is no such thing as invulnerable security.  Computer users are in a no win scenario of fighting a purely defensive war against an enemy operating with complete impunity. That’s an impossible situation.  I think it’s time our government which by charter exists to protect and defend should engage by offering assistance to fortify the vulnerable and aggressively prosecute the perpetrators.

Slightly different scenario here.  When someone breaks into your house and steals your stuff, then you are the only victim.  But when a company fails to protect its client's information in the face of breach after breach after breach, then yes, they hold some level of responsibility.  It's certainly not as great as the criminal's, of course, I totally agree on that one, but these companies have both legal and moral obligation to protect the sensitive data of their clients.

vztrv1 said:

Begging your pardon but you seem to want to punish the victim of a crime here.  If someone breaks into my home is it my fault because I didn’t upgrade my security every month?

The sad truth is just like a house where someone determined enough will break in there is no such thing as invulnerable security.  Computer users are in a no win scenario of fighting a purely defensive war against an enemy operating with complete impunity. That’s an impossible situation.  I think it’s time our government which by charter exists to protect and defend should engage by offering assistance to fortify the vulnerable and aggressively prosecute the perpetrators.

StrangeDays said:

If there are no consistent, firm financial penalties for these companies, they have little incentive to harden their data stores. Every quarter there's another one. Besides corporate penalties, the highly-paid c-suite executives should also be financially penalized. If they don't feel the pain, they can't instill the importance to their teams.

Yeah no. Here in enterprise land (Capital One, Petco, federal govt, etc), securing our customer data is part of the job. In fact it’s the security officer’s entire charge, if the org has one. They’re entrusted with personally identifiable information (PII), bank accounts, credit card numbers, etc. They’re tasked with protecting these assets. Often they don’t and very little happens.

And are you honestly suggesting the federal government should be tasked with implementing security for private companies? Hmm. I feel like the federal departments have enough on their plates doing the same; most of it is contracted out anyway.

I grant your point - companies housing sensitive data do have a duty to employ a reasonable level of security.  The question I raise is what is reasonable.  There is no such thing as 100% foolproof security - anyone who claims to be foolproof will follow the Titanic to the grave.  My concern with your original comment is that you seemed to blame the company with no accounting for their security measures.  Hackers find unknown holes every day - it’s nearly impossible for anyone to keep up with them - especially small businesses and non profits.   Now Robinhood is no small fry but without knowledge of what precautions they did take makes any judgement premature. 

As for the government - I entirely agree that I don’t want them managing anyones internal security - I don’t trust them and applaud Apple for refusing to give them back doors.  What I do want is for them to engage this problem more seriously in police and even militarily terms.  So long as these perpetrators can act with no fear of consequences the crime spree will continue.

StrangeDays said:

vztrv1 said:

Begging your pardon but you seem to want to punish the victim of a crime here.  If someone breaks into my home is it my fault because I didn’t upgrade my security every month?

The sad truth is just like a house where someone determined enough will break in there is no such thing as invulnerable security.  Computer users are in a no win scenario of fighting a purely defensive war against an enemy operating with complete impunity. That’s an impossible situation.  I think it’s time our government which by charter exists to protect and defend should engage by offering assistance to fortify the vulnerable and aggressively prosecute the perpetrators.

StrangeDays said:

If there are no consistent, firm financial penalties for these companies, they have little incentive to harden their data stores. Every quarter there's another one. Besides corporate penalties, the highly-paid c-suite executives should also be financially penalized. If they don't feel the pain, they can't instill the importance to their teams.

Yeah no. Here in enterprise land (Capital One, Petco, federal govt, etc), securing our customer data is part of the job. In fact it’s the security officer’s entire charge, if the org has one. They’re entrusted with personally identifiable information (PII), bank accounts, credit card numbers, etc. They’re tasked with protecting these assets. Often they don’t and very little happens.

And are you honestly suggesting the federal government should be tasked with implementing security for private companies? Hmm. I feel like the federal departments have enough on their plates doing the same; most of it is contracted out anyway.