Hacker News Reader

Depends if it really does end up being one time or not, I'd say

How many times would you need to do a security audit before this paid for itself?

A company of this size? Just 10 or 20 times I'm guessing, which really doesn't seem like a high multiple. This is why laws are required to correct the incentives here.

Not just the audits, but the work to follow through on the audits, too. And follow through correctly.

It's more than $4m though. The company was at real risk of imploding and going out of business. I guess that scared the CEO more than the $4m penalty.

But it's not like the problem is solved now. They still need to secure their systems, especially now that criminals know that this company is willing to pay out.