It keeps happening because there are no consequences for it happening.
If the c-levels at Experian were sent to prison for a few years each time this happens, you can bet your last dollar they'd put measures in place to prevent this sort of thing.
If the c-levels at Experian were sent to prison for a few years each time this happens, you can bet your last dollar they'd put measures in place to prevent this sort of thing.
Worse than that - the consequences are positive for Experian: "For now, Rishi has decided to pay Experian $25.99 a month to more closely monitor his account for suspicious activity".
Aren't CEOs paid "that much", because they carry all those responsibilites? If they're responsible enough to get so much money, they're responsible enough to deal with the consequences of fucking up.
I believe the general argument here would be that if you invest in a company and they later are caught doing something illegal or unpopular, you suffer when your shares lose value.
If in some dystopian future, the C-levels could be given 2 years for what could amount to a basic human error in an otherwise well-run organisation, no-one would do the job and a whole sector of the economy would probably go bust.
Having worked in a handful of companies, at least some of them try to do the job properly but are restricted by employee turnover, lack of consistent skills across the software sector, negligence at any level, incompetence - even if not malicious, tired engineers, ancient software systems that would be impossible to replace in any reason time etc.
>> employee turnover, lack of consistent skills across the software sector, negligence at any level, incompetence - even if not malicious, tired engineers
Pay better, give raises that keep up with the market, and train your people. Basic stuff.
>> ancient software systems that would be impossible to replace in any reason time etc.
Second best time to start is now. Ancient software systems with tons of legacy cruft and obsolete tech aren't going to get any better.
All this costs money, which is the real problem. If there's a market wide failure, as there seems to be in credit reporting, then serious consequences for cheating out on this stuff to undercut your competitors at the cost of security seems fully justified.
That's the point - if the C-level could go to prison then you'd find that mysteriously there were multiple overlapping systems of control implemented such that no one person could make a simple human error and expose reams of customer data: it would require systematic failure.
(At that point, when safety systems are in place but fail for complicated hard to predict reasons, malicious negligence is hard to prove and executives don't go to jail.)