News for hackers. Stuff that matters.

A comment on Intention to fine Marriott more than £99M under GDPR for data breach. Parent comment

Re:Intention to fine Marriott more than £99M under GDPR for ... by IanCal on Tuesday July 09, 2019 @11:38AM (#20392830)
Deliberately not disclosing the breach would likely result in much larger fines.

>If you experience a personal data breach you need to consider whether this poses a risk to people. You need to consider the likelihood and severity of the risk to people’s rights and freedoms, following the breach. When you’ve made this assessment, if it’s likely there will be a risk then you must notify the ICO;

https://ico.org.uk/for-organisations/report-a-breach/

> The GDPR introduces a duty on all organisations to report certain types of personal data breach to the relevant supervisory authority. You must do this within 72 hours of becoming aware of the breach, where feasible.

https://ico.org.uk/for-organisations/guide-to-data-protectio...

[ Parent | on HN ]
Re:Intention to fine Marriott more than £99M under GDPR for ... by buboard on Tuesday July 09, 2019 @11:51AM (#20393007)
There is no definite scale for the fines though, i'm pretty sure negotiating with the hackers will be cheaper 100% of the time. This is interesting from a free market perspective: The undefined cost of the fines would lead to the discovery of the true price of data leaks by negotiating with thieves.
[ Parent | on HN ]
Re:Intention to fine Marriott more than £99M under GDPR for ... by IanCal on Wednesday July 10, 2019 @10:49AM (#20402479)
> There is no definite scale for the fines though, i'm pretty sure negotiating with the hackers will be cheaper 100% of the time

This will not be true if any paid-off breach is ever discovered as then you'll have paid the hackers and the fine, which will be larger because you've deliberately kept it from the ICO/similar.

[ Parent | on HN ]
Re:Intention to fine Marriott more than £99M under GDPR for ... by tapppi on Tuesday July 09, 2019 @01:34PM (#20394425)
What negotiating though? If your huge customer, orders and/or payments database is exploited and dumped and then used for identity/CC fraud, there is no negotiating with hackers. You will be found out eventually due to the proliferation of sold information and data dumps in the black market, which are then analysed by researchers. Then you will be fined possibly twice instead of once or not at all, since you also failed to report the breach.

I fail to think of relevant common situations where negotiating with the hackers would be an option in breaches relating to GDPR.

[ Parent | on HN ]