Cybersecurity Incident Involving Consumer Information

Re:Cybersecurity Incident Involving Consumer Information by elihu on Thursday September 07, 2017 @08:40PM (#15197071)

We don't know how the security breach happened. Should Equifax be criminally liable for using software which contains a remote-exploitable buffer overflow vulnerability? Or for the actions of a corrupt employee who stole some data and sold it on the black market?

It's possible that Equifax did something really negligent and if so maybe there should be a class-action lawsuit against the company. But it's also possible they did all the things they should have done and still failed because security is really hard and maybe the attacker got lucky.

[ Parent | on HN ]

Re:Cybersecurity Incident Involving Consumer Information by CaptSpify on Thursday September 07, 2017 @10:16PM (#15197427)

Isn't the traditional capitalistic argument that the people on top are the ones taking all the risk, which is why they should be making all of that money in the first place?

Note that I'm not making that argument, but trying to understand how this situation differs.

[ Parent | on HN ]

Re:Cybersecurity Incident Involving Consumer Information by dx034 on Friday September 08, 2017 @06:38AM (#15199201)

You take a lot of the risk but not all. If this was due to weaknesses in their IT then managers should be liable. But it's possible that they had one of the most secure systems in finance and still someone found a way in via undisclosed exploits. In that case there's nothing a manager could've done.

But since the core database wasn't hacked, it seems likely that someone had a database dump on a development machine which was outside the scope..

[ Parent | on HN ]