Is it possible that certain companies leave their user data open for attacks to illegally share it with third parties? At this point, it should at least be con

Is it possible that certain companies leave their user data open for attacks to illegally share it with third parties? At this point, it should at least be considered. There's obviously quite a bit of incompetence at Yahoo, but still...