Hacker News Reader

Comment by ryandrake | Hacker News Reader

Interesting how it’s always worded in a way that frames the negligent company as the victim instead of the customers whose data was exfiltrated: “Company X was attacked by hackers,” “Company Y was the victim of a data breach.” Its never: “Company Z failed to secure customers’ information.”

View on HN

I used to do contract pentesting for a big fortune 500 company, and they were able to cut all kinds of security corners because they knew people would perceive them as the victim. The person running our contract at the company said that the people making budget decisions know that at worst there'll be a small stock dip for 1-2 days in the event of a compromise, so they said it's not worth the money to actually have good security because the general public will just see the headlines and consider the company the equivalent of a robbery victim.

When people say there are no consequences for the company yadda yadda yadda what they neglect to also mention is that, typically, there are no consequences for those affected either.

If the one billion odd people affected by major data breaches since 2005¹ all experienced some significant difficulty as a result, we could probably expect a louder outcry and subsequent changes in behaviour by those we entrust(?) our personal identifying information to.

I've been online since well before 2005, and the worst I've experience is one debit card being cancelled due to a failed fraudulent transaction attempt ~10 years ago, and ~2 months ago a successful fraudulent transaction of AU$13.36 which I noticed immediately (thanks mobile banking app notifications), which resulted in the me calling and cancelling the card and the charge being reversed.

Of course, we're all paying more in fees due to insurance against such events, but that appears to be an inconvenience that most people simply don't rate.

1. https://news.ycombinator.com/item?id=18297966

At least in the UK the banks and the police have worked together for years to establish “identity theft” as a thing.

From: Whoops we gave a loan to a stranger because they tricked us!

To: You owe us money because someone stole the core of yourself, from yourself, without you noticing

The police get to move a whole load of theft out of their crime statistics as it modernizes, and the banks get to avoid lots of ‘red tape’ and can decide how nice they want to be to each victim (or rather, how profitable being nice is).

Do you have any citations for that? At least in Germany this is rather unheard of as banks have pretty strict requirements for customer verification. As UK is in the EU as well I'd expect this to not differ too much.

Reply on news.ycombinator.com