I have talked to a number of current and former Weebly employees trying to convince them to use things like hardware token based 2FA, hardened servers, hardened

I have talked to a number of current and former Weebly employees trying to convince them to use things like hardware token based 2FA, hardened servers, hardened workstations, and strong end to end encrypted password management that can't be trivially decrypted from a private key stolen from memory. I had such things written off as being too paranoid when they are too easy -not- to set up. I was not at all shocked by this headline. I don't want to just single out Weebly here as I discuss these sorts of things with people at different companies all over the bay out of personal interest and anything harder than using something like lastpass to reach production systems is considered too much work. Honestly Google and Facebook are the only large companies I have seen deploy fairly decent security practices out of the dozens I have exposure to. I credit this to the fact the employ teams people who have the specific job of continually auditing and enforcing all available security tools on their systems and fostering a culture that security is everyone's job. You will pay for security either way. Either up front paying teams of capable people, or in lost customer trust after the fact. Security apathy in the valley is a cancer impacting companies of all sizes. Sure you can't make anything perfectly secure, but you can at least force your attacker to burn a 0day. Don't make it as easy as spoofing an email and getting an employee to click a malicious link. If you have any sort if privileged access to PII data of your customers and are not even doing basics like using hardware tokens to gate your server and db access you are one keykogger or XSS away from a serious breach. If you know how to set such things up and still don't do it, you are additionally a terrible person. At the very least the data required to readily plaintext the passwords is not public in this case which is a lot better off than companies using only simple hashing like md5. Some credit is due here for sure, but I can't help but strongly suspect the issues here and in now countless other orgs are a result of people having access to PII that don't really care about security or respect the privacy of the user data they are responsible for.