Hacker News Reader

Comment by sys_64738 | Hacker News Reader

It's not a data breach so much as company negligence and liability in exposing customers to fraud. The company is wholly responsible and should have severe punitive damages applied to their business.

View on HN

Even as a Toyota fanboy (which this seems to be a 3rd party not Toyota directly) I agree with you that companies need to be held accountable because what we’re doing now (nothing) doesn’t seem to be working, however I’d caution you about just making this a financial liability for them and ask you to step back and think critically.

If you make this a financial liability, they (any company) are going to purchase insurance like anything else and then offset that cost to the customer - so you’ll just end up paying for it anyway.

Toyota’s costs don’t determine the prices Toyota can charge, and if the expected costs of adding a widget exceed the benefits you can be fairly sure they won’t add the widget.

Fine, in that case companies that take security seriously and/or have frugal data collection and retention policies will be more affordable than their competitors, since their premiums will be cheaper.

OP isn't wrong, and even attackers price in insurance payouts in ransomware demands.

Chubbs, AXA, and others are major players in the Cyber Insurance industry in 2024.

We were going the right path with recent SEC regulations, but those are up in the air now with the Chevron deference decision.

The insurers will cotton on to the fact that companies with good data protection practices, like data minimization and auditing+pentesting your suppliers, pose a lower risk, and they will price that into the insurance products.

To companies taking out insurance, this can look like being denied coverage unless you have evidence of good practices.

But criminal statutes for gross negligence would probably also help.

Insurability and a company's willingness to buy insurance depends on if courts or legislators make it a slap on the wrist that's just a cost of doing business or a real existential liability. Make the penalty steep enough and the only option is to stop the behavior.

When you do business with a 3rd party, and that 3rd party screws up, they are liable.

Otherwise, it's impossible to function as a society.

Reply on news.ycombinator.com