It's a leak because there wasn't an invoice attached to what would otherwise be business as usual: the data being obtained by sketchy third parties.

Marketing companies are sketchy third parties.

That was a significant component of my point.

more sad than interesting because we normally don't know when and which firm(s) got our data. I never heard of this company until today.

I've been a proponent of this idea:

Make companies "super-liable" for any data beyond the data they (actually) need for the functioning of the service that is stolen in a data breach from their servers.

This would hopefully not just encourage more companies to believe that data is "toxic" [1] and treat it as a liability, not as an asset, but it would also encourage them to adopt end-to-end encryption in as many types of services as possible (and eventually stuff like homomorphic encryption or any form of encryption that doesn't give the company itself and hackers direct access to the data).

[1] - https://www.schneier.com/blog/archives/2016/03/data_is_a_tox...

The data in this case is their only asset. They are a data broker, and their entire existence is predicated on the idea that this data is valuable to them.

I think we need to teach people that their data is valuable, likely dangerous in the hands of others, and not to spew it all over the web. Kinda like we did before FB convinced everybody to use their real names.

>The data in this case is their only asset. They are a data broker, and their entire existence is predicated on the idea that this data is valuable to them.

Other than them, who cares? If you want to put people in harm's way, you should accept the consequences when harm occurs.

>I think we need to teach people that their data is valuable, likely dangerous in the hands of others, and not to spew it all over the web. Kinda like we did before FB convinced everybody to use their real names.

No, it's much easier to hold the companies accountable, and they should be held accountable. No company that suffers a "data breach" should have the resources to exist after the breach. Society should punish them out of existence, because they are known cancers.

Considering that their entire business model is "selling this data" then this data is actually needed for the functioning of the service.

I don't know that this invalidates mtgx's general point. Right now, data brokers have effectively zero liability, but we don't treat other companies dealing with dangerous or toxic materials the same way. If a company handling money or munitions left their doors wide open, we wouldn't defend their gross negligence, we'd hold them accountable.

> It's interesting that we consider this a leak only when the marketing firm loses the data.

We don't consider this a leak when the marketing firm loses its data. It's only a leak when we find out that the marketing firm has lost control of its data.

And what really changed? They used to sell the data, right? Now everybody has it (instead of only a percent). Is that worse?

This is pretty much where I’m at as well, on this issue. I only wish there were social security numbers contained in the breach so that we could stop considering them as personally identifiable info.

I agree with your meaning, and I think it goes beyond that. SSNs really are PII by definition; what we need to do is stop pretending that we can use any kind of PII in general as a form of authentication. Whether it's SSN, mother's maiden name, or any of these inane "security questions" that (thank goodness) finally seem to be receding from their peak, we need to move away from the fundamentally broken "tell me something about yourself that only you would know" model of authentication.

Agreed. Thank you for formalizing that ideal more coherently.