The breach definitely sounds illegal, but why the hell were they storing unencrypted passwords in the first place?
When I first learned about databases, that is the very first thing I learned never to do.
When I first learned about databases, that is the very first thing I learned never to do.
Of course, once Facebook et all started using OAuth-like protocols they should have dropped the passwords. There's a lot of shame here for sure, but its not quite as amateur of a mistake as it sounds on first blush.
"This matter now appears worse than originally suspected as the dataset also contains a table where RockYou have stored user credentials for social networks and other partner sites."
http://www.techcrunch.com/2009/12/14/rockyou-hack-security-m...
Also, consider RockYou's initial statement, in which they would only say that no Facebook accounts were compromised:
"RockYou confirms that no application accounts on Facebook were impacted by this hack and that most of the accounts affected were for earlier applications (including slideshow, glitter text, fun notes) that are no longer formally supported by the company."
But you're right about them storing the internal passwords in clear text, which I did not know. That is absurdly dumb.