> If you where (sic) to hold the management criminally responsible for their lack of investment in IT, security etc you might see increased investment.

What makes you think lack of investment in IT & security is the main reason they get hacked?

Vice versa, NSA has virtually unlimited (let's just say unlimited means tens of billion dollars) budget invested in IT and security. They have the top resources there too. Do they immune from data breaches and being hacked? The answer is a big NO!

Correct me if I'm wrong, but the NSA leaks have all been the result of internal employees leaking outward, rather than outside people reaching inward where they shouldn't. That's a meaningful distinction, IMO. They call for two completely different types of defense.

You assume it's different for Equifax.

Hacking humans is quite often the easiest point of entry.

From the Equifax webpage[1]: Criminals exploited a U.S. website application vulnerability to gain access to certain files.

[1]: https://www.equifaxsecurity2017.com/

This is inexcusable in 2017. Hacking humans may be easier but it's up to Equifax to figure out how to mitigate that risk. "It's hard" doesn't excuse their behavior.

NSA has leaks, that is different, these guys were actually negligent with your and my data, probably underpaid their developers, didn't listen to them, didn't have proper security protocols etc, etc.

Certainly a lack of mental investment. The NSA and these credit agencies are not a comparison, as their jobs are quite different. If nothing else, the NSA has to be connected to public networks to do their covert operations. Not so with a "credit rating agency". They should not be on a public network at all. Before the Internet, they were not, they were on private leased lines.

You missed the point. I am arguing that no amount of investment is big enough to make data breaches go away. Even the top intel agency with top budget and top resources can't avoid breaches, what else would you expect a corporation?

However this is not an excuse for Equifax to not put more focus and investment on their security.

> I am arguing that no amount of investment is big enough to make data breaches go away.

Sure, nothing is totally secure against a dedicated, motivated attacker with unlimited resources. Thankfully those are few and far between.

Based on that Equifax has said that this doesn't seem to be the case.

Your argument that credit rating agencies shouldn't be on the internet is really terrible.

People pay credit rating agencies to retrieve their credit reports, get credit scores, and open disputes, and the best way to do all that is online.

Yeah, but then they realised they could monetise it by selling your own data back to you with easy, constant, access to it via the web.

High. And they won't be the only agency. I guarantee you we'll hear from the other 2 in the next month or so. Because people aren't held criminally responsible for the security of user data, so why give a shit?

My guess is they paid an 3rd party bs service to "scan" their site for vulnerabilities.