With great power comes great responsibility - yah I know this is cliche but it is true. While I would love to see services like HIBP used to improve the overal

With great power comes great responsibility - yah I know this is cliche but it is true. While I would love to see services like HIBP used to improve the overall security of the Internet, I also have my doubts that it will be useful and I speculate that in some instances it may be actually harmful. Naming and shaming the companies who have bee breached at some point in time is only good for a while but not forever. Just like the prison system, carrying the extra baggage of being labelled a criminal at some point is not constructive and in fact, it has been proven countless of times that it is anything but detrimental. If the service delivers a one-time notification when the breach occurred (sort of a broadcast) that will be very useful and it will help users stay secure while keeping the companies incentivised to ensure their shit is tight. But if the service offers warnings even for breaches that occurred 2 years ago, then I speculate this is only going to make companies pay out ransoms in the form of "Bug Bounties" when they get breached. With the introduction of GDPR this is only going to make it a more lucrative way to make legitimate money through criminal activities. Last but not least, I know there are quite a few people on this "forum" that actually do security for a living so they may object but I've been also doing this all my professional life and what I've learned is that no one is protected. Banks are just as easy to hack as anything else and people tend to think that all it matters is customer data - what about employee data? What about your government records? It is not so black and white at the end and while it is easy to point out the problems, it is much harder to fix. I know this sounds like an excuse but most pentesters, security researchers, etc. do not run extensive infrastructures themselves and when they write code, while sometimes technically challenging, it is hardly more than a few thousands of lines monoliths with fairly straightforward logic. Most of this software is poorly written (yes there are quite a few exceptions and we all know them). That does not make them/us great codders - just great at discovering and exploiting vulnerabilities. The reason I am mentioning this is because with my security hat on I can easily point the problem, laugh at it and wonder why it was not fixed but I have also seen the other side too. Building a company from scratch is anything but simple and you have been doing this for more than 5 years you are likely to have legacy systems already, which is crazy but this is how fast technology is moving. So yes, things will get hacked. We need to change our entire mindset how to run companies in order to prevent this and as far as I know, no one has figured it out yet.