7 ms·
Will they be penalized? Was Equifax ever penalized? The cost to them so far is some bad PR which will probably blow over. Especially for companies like Marriot
by fatjokes 8y ago
Will they be penalized? Was Equifax ever penalized?
The cost to them so far is some bad PR which will probably blow over. Especially for companies like Marriott and Equifax which have near monopolies (Marriott owns several smaller chains like Starwood and Ritz Carlton), this probably won't affect their customer loyalty. Particularly when it's safe to assume that the other chains are probably not doing a better job.
Marriott currently has no incentive to spend money to do a good security audit.
They had incentive to do their recent migration of loyalty programs, since Starwood's program was notably generous.
- robin_reala 8y agoGiven that they have EU customers I imagine that yes, they’ll be penalised.
- GordonS 8y agoGDPR is very recent - do we know exactly when the compromise was? If it was before GDPR came in, they might be able to weasel out of any potential penalty.
- walshemj 8y agoAnd logging passports of foreign visitors is the norm in the EU - I suspect the national security exemption would apply - be interesting what the European court of justice would say if asked.
- jahewson 8y agoMarriot and Equifax may be big but they're not even close to being "near monopolies". Neither has even 50% market share.
- freehunter 8y agoI would substitute the word 'monopoly' with something like 'unavoidable' or 'compulsory' or 'inescapable'. They're not the only options or even the majority option, but for many of the people impacted by this breach it makes no difference. Many of them were forced into it. I've never been asked which credit bureau I preferred to have my information given to or taken from. And while I have some say over which business hotel chain I stay at, ultimately it's up to my client or my employer to set the policy. If the rates at the Hilton are out of compliance with the company's willingness to spend, I'm staying at the Marriott. Monopoly is the wrong word, but the sentiment of hopelessness is the same.
- throwaway5752 8y agoWe can look at their precautions or lack thereof and see if that constitutes negligence. But regardless of negligence, Marriot and Equifax were victims of criminals. Were the perpetrators ever identified and punished? "Marriott currently has no incentive to spend money to do a good security audit." I bet they've had good security audits.
- darkpuma 8y agoIn cases where the 'victims' are corporations, punishing 'victims' is totally acceptable. Don't let rhetorical conflation between between humans and corporations fool you.
- crandycodes 8y agoPut another way: Marriott is the victim of "cyber" crimes. Marriott's customers are victims of Marriott's negligence. I'd argue it has nothing to do with corporation or non-corporation. If someone is injured in a car accident due to an unfastened seatbelt, the driver is also potentially both a victim (assuming they weren't at fault for the accident) and guilty of negligence (for not making sure safety equipment was used properly).
- alexis_fr 8y agoMore like, if a car is caught in a pile-up accident, it is both guilty of hitting the car ahead and victim of being hit by the next car. If he was pushed by the back car into the front car, and took all necessary precautions, he can call for a kind of force majeure and make the back car pay for both, but the agressor has to be formally identified. Mariott didn’t take enough precautions to pretend being victim of a hacker.
- throwaway5752 8y ago"Mariott didn’t take enough precautions to pretend being victim of a hacker." Marriott was literally, prima facie, the victim of a hacker. The data didn't steal itself. Someone trespassed into Marriott's network and stole data that did not belong to them. Legal culpability, while certainly not the strong point of HN, is a thing. Negligent, grossly negligent, and reckless conduct are technical terms that exist and have meaning. I'm sick of replying to this because I don't like defending Marriott in this case. I hope they get a painful class action ruling. I think legal reforms around this are needed, but I am entirely unconvinced anyone here has a reasonable framework of regulations that would benefit anyone.
- flyGuyOnTheSly 8y agoCould a class action lawsuit on behalf of the 5M people who had their passport numbers stolen penalize them for punitive damages somehow, perhaps? Crossing borders is stressful enough as it is. If there is now added worry that you might be flagged as a terrorist or lord-knows-what because some nefarious person now has your passport numbers and personal details... surely that must be worth something?
- techntoke 8y agoGood luck with your free year of credit monitoring and a check for $5.00.
- flyGuyOnTheSly 8y agoThat's what might happen if you allow Marriott to dictate the terms... not the other way around.
- 29083011397778 8y agoThe point isn't a personal payout, the point is to hold the negligent party responsible
- lisper 8y ago> Will they be penalized? Was Equifax ever penalized? No. And no.
- SilasX 8y agoI just checked, and it looks like Equifax recovered to 95% of its pre-hack peak within about a year. (July 2017 peak of 145, then 137 last September, now 95.) Sorry for the long link: https://finance.yahoo.com/chart/EFX#eyJpbnRlcnZhbCI6IndlZWsiLCJwZXJpb2RpY2l0eSI6MSwiY2FuZGxlV2lkdGgiOjEwLjc0MDM4NDYxNTM4NDYxNSwidm9sdW1lVW5kZXJsYXkiOnRydWUsImFkaiI6dHJ1ZSwiY3Jvc3NoYWlyIjp0cnVlLCJjaGFydFR5cGUiOiJsaW5lIiwiZXh0ZW5kZWQiOmZhbHNlLCJtYXJrZXRTZXNzaW9ucyI6e30sImFnZ3JlZ2F0aW9uVHlwZSI6Im9obGMiLCJjaGFydFNjYWxlIjoibGluZWFyIiwic3R1ZGllcyI6eyJ2b2wgdW5kciI6eyJ0eXBlIjoidm9sIHVuZHIiLCJpbnB1dHMiOnsiaWQiOiJ2b2wgdW5kciIsImRpc3BsYXkiOiJ2b2wgdW5kciJ9LCJvdXRwdXRzIjp7IlVwIFZvbHVtZSI6IiMwMGIwNjEiLCJEb3duIFZvbHVtZSI6IiNGRjMzM0EifSwicGFuZWwiOiJjaGFydCIsInBhcmFtZXRlcnMiOnsid2lkdGhGYWN0b3IiOjAuNDUsImNoYXJ0TmFtZSI6ImNoYXJ0In19fSwicGFuZWxzIjp7ImNoYXJ0Ijp7InBlcmNlbnQiOjEsImRpc3BsYXkiOiJFRlgiLCJjaGFydE5hbWUiOiJjaGFydCIsInRvcCI6MH19LCJzZXRTcGFuIjp7Im11bHRpcGxpZXIiOjIsImJhc2UiOiJ5ZWFyIiwicGVyaW9kaWNpdHkiOnsicGVyaW9kIjoxLCJpbnRlcnZhbCI6IndlZWsifX0sImxpbmVXaWR0aCI6Miwic3RyaXBlZEJhY2tncm91ZCI6dHJ1ZSwiZXZlbnRzIjp0cnVlLCJjb2xvciI6IiMwMDgxZjIiLCJldmVudE1hcCI6eyJjb3Jwb3JhdGUiOnsiZGl2cyI6dHJ1ZSwic3BsaXRzIjp0cnVlfSwic2lnRGV2Ijp7fX0sImN1c3RvbVJhbmdlIjpudWxsLCJzeW1ib2xzIjpbeyJzeW1ib2wiOiJFRlgiLCJzeW1ib2xPYmplY3QiOnsic3ltYm9sIjoiRUZYIn0sInBlcmlvZGljaXR5IjoxLCJpbnRlcnZhbCI6IndlZWsiLCJzZXRTcGFuIjp7Im11bHRpcGxpZXIiOjIsImJhc2UiOiJ5ZWFyIiwicGVyaW9kaWNpdHkiOnsicGVyaW9kIjoxLCJpbnRlcnZhbCI6IndlZWsifX19XX0%3D https://finance.yahoo.com/chart/EFX#eyJpbnRlcnZhbCI6IndlZWsi...
- pgrote 8y ago>Will they be penalized? Was Equifax ever penalized? No and no. Our Federal government is beholden to special interests, so no real legislation or regulation addressing this issue will ever occur. If Equifax (a brace of our economy) didn't receive the death penalty for what they were responsible for, nothing will occur to any future company.
- kerng 8y agoMarriot likely leaked European customers information also, so there will likely be a penalty. Probably pretty small though.
- sandworm101 8y agoI've been on the inside of some leaks and associated internal investigations. There may not be an external penalty, but these are a serious internal headache. You often have to bring in external people, who then always see the worst in everything. The board has to be kept up to speed. The meetings and late nights pile up. The absence of external penalty doesn't mean that those on the inside don't care. I'd say that most corporate infosec is motivated primarily by the desire to avoid internal investigations. Avoiding the need to report anything to shareholders and/or corporate partners comes second. External penalties is a distant third.
- karmelapple 8y agoThat’s only motivation for InfoSec, though. The CEO has to be motivated to practice good security by the bottom line implications; if having a security incident means less profit, a conscientious CEO will make sure to mitigate that risk, or at least factor it into the tradeoffs of what to do. Without any significant monetary threat, the ultimate cost of security breaches to a company isn’t truly a big deal.
- burtonator 8y agoOne of our customers who works in the security space was discussing how 'professional' the CC resale industry is. They have customer service centers, will give you refunds if the CCs don't work, etc. Really insane. I expected it to be shady but apparently it's a big business now!
- mannykannot 8y agoIt probably has better security.
- darkerside 8y agoI've never understood how it is that we can't detect and prosecute organizations when they're big enough to provide individualized customer support over the phone.
- lostlogin 8y agoAre you referring to the credit card hackers or those who didn’t make much effort to secure customer details? Snark aside, both deserve consequences.
- darkerside 8y agoI know corporations should do better, but these attitudes strike me as victim blaming. End of the day, this data was stolen.
- lostlogin 8y agoI see the victim as the customer, not the corporation. Yes they had data stolen from them, but if there is no consequence and it wasn’t their data, are they the victim?
- na85 8y ago>Will they be penalized? Was Equifax ever penalized? Above a certain wealth threshold, corporations and their CEOs are above the law.