Serious question from someone who takes their privacy seriously. What actual harms have we documented from these breaches?
Actual, not hypothetical. Again, I believe this happens. But why is it so difficult to document?
- My old university - T mobile - My health provider
Now if you try to sue any one them regardless of their arbitration mandatory you would have to prove that the harm is because of this particular institution and not the others.
And the notion of identity theft is putting the blame on the people where the actual victims are the banks/dealers and not you. But it is easy to put the responsibility on you.
No, you'd just have to show the first part. That they caused harm.
> the notion of identity theft is putting the blame on the people where thr actual victims are the banks/dealers
This is a real problem. But I haven't seen anyone successfully tie a case of identity theft, even in part, to a particular breach.
These companies have deep buckets and will employee laywers who have experience into squashing all the suits of this kind.
Edit: I have much less faith that your question in the beginning was serious with good intentions now.
Again, this is not true. If two people steal your data, and you can tie the use of any of that stolen data to harm, they are each liable. The problem is in identifying the harms. Not calculating the attributed damage.
> companies have deep buckets and will employee laywers who have experience into squashing all the suits of this kind
A multibillion-dollar payoff for lawyers and a wealthy plaintiff to get a class certified, and the answer is a conspiracy of corporate counsels?
Sure. But why are these database operators' tradecraft so universally solid that nobody can back out attribution, including law enforcement when they search and seize them?
Mature response. Now actually think about it. If you solve this, you've solved the key barrier to incentivizing change. If you can't answer it, then security seems more like an aesthetic preference than a social problem.