If it's really as dire as you say, you must blow the whistle on this.

The German commissioner for data protection might be interested:

https://www.bfdi.bund.de/DE/Service/Kontakt/kontakt_node.htm...

In case you'd rather not do it through official channels (or in addition, just to keep them on their toes), may I suggest:

https://www.heise.de/tippgeber/

https://securedrop.theguardian.com/

As someone who is going through a data protection audit with his company: They take the process very seriously and ask some tough questions. It's better to be prepared and play it right from day 1. Proper documentation matters as well.

Could you elaborate?

> it would be illegal to create such a DB without the consent of those whose information is stored in them.

I can imagine such an entity, at least in Germany: the Schufa, a credit rating service. It's impossible to open bank accounts, get credit or phone/internet contracts without all this going into their DB.

Better hope they secure their systems. Credit rating companies are, from their model of business, rotten to the core - and pose an extremely high risk these days where everything is computerized.

Experian are the UK equivalent - it's exactly the same, everything you do involving credit goes through them.

I am simply waiting for the github hack. This will be a disaster of epic proportions. The crown jewel.

That almost happen couple of years ago with that nasty default rails behaviour that /u/homakov alerted them about.

Yep, that will be the internet crusher.

How so? I'm genuinely curious.

Access to all private Github repos??

And all the keys/passwords stored there!

I was about to say "who in their right mind stores PW info in github?" before I realized I've worked several projects that do just that. Crazy decisions, but at least as a small mitigation, all that PW data needs access to a VPC to be useful, and that access isn't part of GitHub. Still not good practice by any means.

Having come up working on classified systems, it pains me greatly to see such lax security.

Plenty of people already fell for the "mirror your dot-files to Github" fad, which dumped vast quantities of exploitable data into public repos. Amazon somewhat mitigated the leaked AWS keys, but who knows how many other passwords, etc. went unfixed?

The exact reason many don't repo there.

I've seen plenty of places with this mindset.

Instead of risking their data in the motherlode of hacks occurring against Github they setup on-premise Github/Gitlab/Bitbucket/etc. then let the servers go unpatched, stay several versions behind, don't bother setting up authentication roles properly and give people more access than intended.

There are plenty of places doing on-premise right, but I definitely trust Github over the average undermaintained on-premise installation.

Yeah that's a fair point

Which entity, and have you reported them to anyone?

I think part of Troy's argument is that buying and selling this sort of information is technically legal - ergo making reporting pointless.

I guess the other side of that argument means that mentioning who sells it shouldn't be a problem either.

Not everywhere. Significantly it's not legal to be moving EU Personal Data out of the EU. And these guys are going to get hit hard (including personal liability for their privacy officers). It would be responsible of OP to report it to them but theirs no real obligation for him to do so. It's on them to protect it.

It might be legal, google for "us eu safe harbor privacy framework".

But you need a consent to collect that data in the first place.

You were certainly right (and still are, depending on how you read your comment). I'm not a lawyer, but I believe that Safe Harbor is no longer safe to rely on (since a 2015 ruling). There's Privacy Shield and the soon to come into force GDPR, though, which have restrictions like the one you mention.

> including personal liability for their privacy officers

Hah, there's one big assumption you are making there...