Hacker News Reader

Comment by bronbron | Hacker News Reader

Part of me wonders if security will ever be something people actually care about, and value.

Home depot had a huge, huge security breach. Their stock price? Up 12 points from last year.

I'm not sure what it would take for people to really value a major security breach. The tech guy inside me is screaming, "why wouldn't you care about this?", but the regular guy inside me thinks, "who cares? the banks will handle any stolen credit card info."

View on HN

I don't really know much about this sort of thing. I assume that to the retailer that gets pwned, they get a few weeks or months of bad press then pass the cost of that breach on to future customers.

The "regular guy" in me thinks, "Meh, I'll probably ending up paying 5 cents more for light bulbs because of this. Oh well."

I feel bad for the sysadmin/security guys at these companies, probably screaming for budget and not getting it. What do you think they're doing now? Helping some high paid IR consultant restore logs from backups. Good times!

Deleted comment

Why are you assuming that this only applies to Home Depot issued credit cards? I am not getting that sense from the article.

Nowhere near half of all households have a Home Depot card. There were 56M "payment cards" compromised. That would be Visa, Mastercard, and whatever other cards they accept. "Payment card" sounds awkward to me, but with so many people using debit cards, they can't say "56M credit cards."

Well, we should find out as NFC and biometric authenticated payments (Apple Pay and TouchID) are about to hit the mainstream US consumer market in a big way. I'll certainly think twice about shopping at any big box retailer (ie the bigger targets, no pun intended) that doesn't let me pay that way.

That's the whole point of the liability shift. It will matter a lot more when the store is wholly liable, instead of this conditional liability depending on "indications of shortcomings in their security".

(In a year or so, stores that don't use EMV assume liability for fraud)

Indeed. When large breaches happen after that date, the liability will fall upon whichever party had the poorer security, and you'll see a lot more class action lawsuits.

It's mainly up due to a good earnings report in August, and good guidance going forward.

If the breach doesn't hurt earnings, why should the stock price move?

That's the OP's point. If folks cared about security you would expect a backlash from customers because of the breach directly impacting earnings.

For Target, the selling didn't come until after Target announced it was going to impact their earnings.

Reply on news.ycombinator.com