They may be non-malicious, but they show that someone with an intent to harm could do far worse and that most are completely unprotected.

Its better to expose problems than live with the false security that none exist. The false security leads to much worse breaches when they happen (see Sony) would be nice if Lulz hacked Sony 3 yrs ago and went public.

It sounds like a reverse lottery of pain to me. If LulzSec looks at you, you get to spend millions beefing up security while your competitors do nothing.

>If LulzSec looks at you, you get to spend millions beefing up security

...or, you know, be competent in the first place.

They can choose when and where to attack, but you have to defend everywhere all the time. I suspect we're in a situation where cost of being competent > probability of lulz * cost of remediation.

>I suspect we're in a situation where cost of being competent > probability of lulz * cost of remediation.

Yup, unfortunately this is true, and half-assing it because of this is what gets us onerous new internet legislation.

Wait, is LulzSec actually doing anything interesting here or are they just DDOSing everyone? The EVE Online comment makes it sound like it's just a bunch of guys with LOIC...

That's what it's sounding like. Minecraft seems to have restored services; EVE Online has confirmed it was a DDoS[1] and is still investigating. Escapist Magazine still seems to be down.

I think the only thing they're really proving is what we already know: nearly everyone is vulnerable in one way or another; robust security is tough.

[1] http://twitter.com/#!/EveOnline/status/80732212898697217

LulzSec is starting to sound like a false-flag operation to me...