Snoonet people seem to be heavily involved with IRC.com stuff, which isn't very surprising considering Andrew bought snoonet. In the past there have been some very credible accusations[1] from ex-snoonet operators claiming that snoonet operators spy on users messages.

I don't know if I'd trust IRC.com.

[1] https://bpaste.net/show/932b93fc2dce

  <rdv[swag]> ENOUGH
  <rdv[swag]> THIS IS MY NETWORK AND I WILL RUN IT THE WAY I WANT TO RUN IT
  <rdv[swag]> YOU CAN ALL QUIT FOR ALL I CARE

PIA decided to hire this person AFTER other network staff called him out for spying on users.

Oh and PIAs support site and customer DB were compromised using a deserialization vulnerability in kayako. They never bothered to publicly acknowledge this, clearly a very "privacy oriented" business.

Kayako seems to have taken down their page detailing this particular vulnerability. Their helpdesk product used to store users sessions as serialized objects in user-controlled cookies, allowing attackers to execute arbitrary code by just sticking an appropriate php object into their cookies.

Any automated auditing tool would've immediately discovered this bug, so clearly PIA just didn't bother.

The cookie looked like this, it's impossible to miss the serialized php object:

  Set-Cookie: SWIFT_client=a%3A1%3A%7Bs%3A15%3A%22templategroupid%22%3Bs%3A1%3A%221%22%3B%7D; expires=Wed, 28-Dec-2016 23:24:13 GMT; path=/; httponly

But hey, maybe their new CTO - Mark Karpeles - runs a tighter ship ;P