I think that for-profit organizations actually mesh quite perfectly with the "security economics" perspective. Ie, they care about security to the extent that

I think that for-profit organizations actually mesh quite perfectly with the "security economics" perspective. Ie, they care about security to the extent that they see it affecting their own utility function. In ideal circumstances, negative externalities like the impact on the breached users flow back into the company's incentives via bad PR. The problem is that there's a shortcut: it's inherently easy to hide security breaches, given that the security domain already involves a baseline level of opacity (as opposed to, say, product or pricing decisions). As it often is, the approach here should be to reconnect this feedback loop, by regulating and vigorously enforcing penalties for failing to disclose breaches. Suddenly, the "value" of security from the perspective of the organization drops precipitously. To make matters worse, hiding security breaches causes collateral damage by making mitigation by its victims harder (if no one tells me my SSN was leaked, I won't (eg) freeze my credit report). The answer, as it often is, is for regulatory pressure and robust enforcement to connect the externality's consequences back to the agent. The easiest step is by requiring disclosure of breaches. As such, the news in this article seems like it should be unequivocally celebrated.