Is anyone able to assess the quality of information security at GSK? I would expect reasonably protective InfoSec from 23&Me because of their close ties to Goog

Is anyone able to assess the quality of information security at GSK? I would expect reasonably protective InfoSec from 23&Me because of their close ties to Google, but GSK feels like a company too large to care, and without enough hackers at the top to be worried. I was taken aback by 23&Me’s anti-deletion contract, but with good security, I only have them to fear. If someone less scrupulous can access it, then I depend on their own security and that cascade tends to end up on haveibeenpwned.