> However, what if keeping customer information secure was a contractual obligation as part of offering products for sale, or services for hire? "keeping custo

> However, what if keeping customer information secure was a contractual obligation as part of offering products for sale, or services for hire? "keeping customer information secure" is not a binary. Most companies that are breached don't know about it until their dat hits the black market. Yahoo! revised their data brach estimates upwards half a dozen times from 100million+ to ~3billion+. The plaintiffs would have to affirmatively prove that a breach happened to the defendant when most defendants don't even know that it happened. It is even harder to contractually enforce when the victim claims it was a nation-state-actor/APT since no company could hold out against a determined APT indefinitely. I'm hopeful that cybersecurity insurance policies will move the needle towards accountability and increased prevention (insurance policies will require good-faith efforts at security policies+procedures+tools+employee actions or they won't pay out).