Interestingly the law strikes a decent balance here. For example, the FTC can sue a company for 'unfair and deceptive business practices'. Exposing cars to inst

Interestingly the law strikes a decent balance here. For example, the FTC can sue a company for 'unfair and deceptive business practices'. Exposing cars to insta-theft because you didn't secure your backend database could fall in that category. Companies do have a duty of care if they are holding the keys to the castle, be it the keys to your car, or keys to your email or financials; they have to take reasonable precautions to protect the data, commensurate with the quantity and sensitivity of the data, and the cost and availability of technology to protect that data.