I'm in two minds about the actual penalty notice given here. On the one hand, it's good to see an organisation receiving a real financial penalty after a serio

I'm in two minds about the actual penalty notice given here. On the one hand, it's good to see an organisation receiving a real financial penalty after a serious breach, and apparently there were many serious failings in security on the part of Carphone Warehouse. On the other hand, reading the Commissioner's views in the notice, there is a disturbing amount of commentary about measures not in place at Carphone Warehouse that asserts apparently without evidence that such measures are widely accepted security standards, either acknowledges that these measures may not have made any difference to this kind of attack anyway or implies again apparently without evidence that they would, and then considers the lack of each such measure to be a contravention in its own right. I'm not sure this is a good thing, because if we took the principles indicated by those views and applied them more generally, I'm not sure many if any organisations would meet the required standards here. For example, how many organisations that use WordPress to run their web sites have measures in place to detect unauthorised use of legitimately issued WordPress credentials? What would that even look like? How many small organisations have a dedicated WAF box installed, or the money to run regular independent pentesting or hire suitably qualified in-house staff to do it? (Obviously we're not talking about a small organisation in the case at hand, so maybe the ICO would apply a more liberal standard in other situations.) There is a reference to transaction data being encrypted but the encryption key being present in plain text in the application source code. Well, OK, but that key has to be present somewhere accessible on the system or you can't access the data at all even for legitimate purposes. If you've got an attacker who apparently already has access to both your database and your runtime system, I'm not sure what alternative they would have preferred to see that would have mitigated the damage materially here. Does it really matter whether the attacker looks at source code or somewhere else like environment strings, if the end result is the same either way? Compared to obviously terrible practices like not updating externally accessible software for many years so the live version has multiple known vulnerabilities or storing full credit card data including things like CVCs for all historical transactions, some of the issues raised here seem both much more dangerous and much more practically mitigable than others.