In my opinion, this is a failure of due diligence on behalf of the Mozilla Corporation. I'm sure their legal team is jumping into incident response mode right n

In my opinion, this is a failure of due diligence on behalf of the Mozilla Corporation. I'm sure their legal team is jumping into incident response mode right now. I think this is one of the problems of organisations not doing anything themselves, and offloading responsibility and liability to both external partners. If you trusted Mozilla Monitor with your personal data, their legal contact information is listed on their terms page: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/ https://www.mozilla.org/en-US/about/legal/terms/subscription... The same terms page you agreed to which both limited their liability to $500, and granted them indemnification from liability.