> Yes, it was stupid for them to have everybody's PII attached to that one webserver. No, see, this right here is the part where you and I disagree with each o

> Yes, it was stupid for them to have everybody's PII attached to that one webserver. No, see, this right here is the part where you and I disagree with each other. This wasn't stupid, this was negligent. Once you have a certain amount of customer PII, you have to act like an adult. You put all the PII behind a special interface and database and hire a well-paid team of security specialists to take care of it. There should be people whose entire job is to read about new exploits and be updating that PII system within hours, not weeks. A good PII system should have triple-A: authentication, authorization, auditing. You should know for certain who is calling the PII system, how often, for what records. You should have automatic audits/alarms looking for clients who are suddenly increasing their call rate (or better yet, rate limit each client). Automatic searches for clients whose behaviour has changed suddenly. When someone is clearing out your PII, you should know very quickly. Equifax did not do the adult things. They got owned, and now 150m people are at risk.