I think its about time US passes laws that any company that suffers a data breach is mandated to give a identity theft protection for 1 year to people who's information was compromised.
Instead how about companies have complete financial liability? That way they'll need insurance, and their premiums will skyrocket if they get breached.
They should instead have a minimum fine per-user that gets paid in cash directly to the impacted individuals. Paying $10 x 1M accounts would make businesses wake up to this problem much faster. Maybe even have the fine be tiered based on the level of data that was compromised:
Email - $10
Hashed Password - $25
Plaintext Password - $100
SSN - $500I'd rather them give basic compensation to anyone with breached data (even if it is $10) in addition to covering the costs of anyone who had problems after the breach. The first year, I'd think it would be best if the consumer didn't have to prove it was their fault as that could be too much of a burden for folks.
I'd give an exception for companies that went over and above on their own security and still got breached. After all, security doesn't make one completely safe (much like places can still get robbed), simply less likely.
> T-Mobile declined to comment. "We don't discuss publicly how we encrypt passwords,"
That is unacceptable, data breach or not.