Not even close. The only case I could see it happening was if you purposefully exfiltrated data and sold it, or got some sort of personal gain out of it.

It's the same thing with PCI. They say you can go to jail for violations but exactly 0 people have ever been prosecuted, despite constant negligence in the payment industry.

Nope. Definitely not rank-and-file engineers.

Suppose you fucked up, and the worst happened: You were the reason the database was misconfigured. What then?

Then you live your life. You think future employers are going to pass on you because of it? Maybe some would. Most don't give a shit. They care about one thing and one thing only: whether you can help them achieve their objectives.

Morals are a fine thing, but the reality is that the original comment was correct: Nothing will happen to these people. As it should be.

They are required under law to notify the affected people. THat's the extent of what will happen. There may be legal repercussions for the company. And I'm sure the engineers will feel pretty awful at this mistake. I know I would. Everyone does.

But that doesn't change the fact that the world is insecure.