4 ms·

I never got the impression that the market ever cares about data breaches. It seems most companies are rarely held financially responsible for data breaches any

I never got the impression that the market ever cares about data breaches. It seems most companies are rarely held financially responsible for data breaches anyway. I would bet any effects you’re seeing in stocks is unrelated to this news.

smcin 2y ago
They are very much related to the news, that's precisely why I linked to the stock charts: AT&T was flat overnight but opened (9am ET) with a -2.6% spike down, but has been recovering since. Their press release appears to have been Friday 7am ET shortly before market open [https://about.att.com/story/2024/addressing-illegal-download.html https://about.att.com/story/2024/addressing-illegal-download...]. Also as corroboration here's MarketWatch: "AT&T’s stock slides 3% after company discloses hack of calls and texts" [https://www.marketwatch.com/story/at-ts-stock-slides-2-9-after-company-discloses-hack-of-calls-and-texts-908a5fa1 https://www.marketwatch.com/story/at-ts-stock-slides-2-9-aft...]
- soulofmischief 2y ago
  I'm not saying there's no way the stock pullback wasn't caused by the hack, but it's also important to note that MarketWatch article only establishes correlation, not causation.
  - seadan83 2y ago
    Most linked financial news is auto-generated and auto-correlated. Lots of "why did.." when nobody knows, and frankly there often is no why. Perhaps that was the day a retirement fund shifted money, who knows. While this price movement is very well correlated, perhaps causal even, but marketwatch (and all similar bottom feeders that are just trying to make ad revenue), it's a case of a broken clock being right. Those financial news sites which link recent news to stocks, eg Yahoo, benzings, - those recent news headlines are just the same as ad tech now. It is noise.
graybeardhacker 2y ago
I agree. This is precisely why breaches keep happening and will keep happening. It cost money to implement security. There's no cost benefit to spending that time and money since there are no consequences. Businesses do not spend money unless it will make them money or save them money. There needs to be a hefty federal fine on a per-affected-user basis for data breaches. Also a federal fine for each day a breach is unreported. That money should go into a pool which can be accessed by people who have their identity stolen.
- ThunderSizzle 2y ago
  Or a lawsuit go through where someone can win quite a bit from from data leaks. If each person affected sued and won 100k or so, or even 1k, AT&T would definitely be spending money on security. But it appears $5 or credit monitoring from an agency that also gets hacked is sufficient for class action lawsuits.
  - malcolmgreaves 2y ago
    That requires people to be rich enough to sue. It takes a lot of money and time to sue. Almost no one has enough resources to do this. The courts are not an effective way to implement this policy. Unless you only want rich people to be able to get justice.
    - CityOfThrowaway 2y ago
      110M people impacted = class action The lawyers work on contingency
      - unixhero 2y ago
        Imagine the GDPR fine
        BrandoElFollito 2y ago
        Up to 4% of income. This is not the end of the world either.
chung8123 2y ago
I think they will care a lot more when it directly impacts them. If all their text conversations were publicly available that would cause some outrage.
rybosworld 2y ago
There is some evidence that it does hurt stock prices: https://www.comparitech.com/blog/information-security/data-breach-share-price-analysis/ https://www.comparitech.com/blog/information-security/data-b... "Stocks of breached companies on average underperformed the NASDAQ by -3.2% in the six months after a breach disclosure" That said, it's not clear what the long term impact is on stock price (if there is any).
- teraflop 2y ago
  Unfortunately, that analysis seems to have made absolutely no attempt to check whether the results are statistically significant. Pick 118 random companies at 118 random points in time. It's vanishingly unlikely that the average returns of that group will exactly track the NASDAQ returns over the following 60 days. It might underperform, or it might overperform. An underperformance of 3.2% could easily just be the result of random chance, and have nothing to do with data breaches.
  - jkaptur 2y ago
    My hypothesis would be that companies with poor operational practices are more likely to underperform the index and have data breaches - in other words, that the study confuses cause and effect. This wouldn't be that hard to test. I suspect that the breached companies underperformed in the six months before the breach as well as the six months after.
    - Terr_ 2y ago
      Also, events which are not "just" data-leaks but also interruptions or degradation in regular operations. I suspect investors may be more sensitive to those events and their fallout, and such events more likely to either be caused by bad-practice or to be somehow connected to data-leaks.
weezin 2y ago
Really should be up to the government to fine these companies and pay out to those effected to disincentivize lax security standards.
- kcmastrpc 2y ago
  How would such damages be assessed or proven?
  - Eisenstein 2y ago
    They would be assessed according to rules written by people who are skilled at writing such rules. The rules would be evaluated by looking at data over time and revised as needed by experts in the industry who are as neutral as possible, maybe with some feedback from the public. The courts exist for any contention regarding responsibility.
- hodgesrm 2y ago
  Well, I guess we devs should also be looking at ourselves, then. A lot of the lax security comes from us collectively choosing to build applications using cloud services that talk to each other over the public internet. That pretty much describes the so-called "modern data stack."
nashashmi 2y ago
Insurance takes up a lot of the fallout from data breaches.
darby_nine 2y ago
I'm certainly not going to defend negligence of data protection but it's extremely difficult to cost as a liability (naively, you might even consider it not a liability at all) without government oversight.
hodgesrm 2y ago
> I never got the impression that the market ever cares about data breaches. It seems most companies are rarely held financially responsible for data breaches anyway. This might also explain why there's little visible effect on other cloud database services either. After all, the attack is pretty simple and potentially affects any cloud database that allows access from the Internet.
deleted 2y ago
[deleted]
omoikane 2y ago
My reading is that the market thinks Snowflake takes the majority of the blame, and the content of the linked article seemed to suggest as much despite having only AT&T in the headline.
lp0_on_fire 2y ago
The market doesn't care precisely because there is never any accountability.
Vicinity9635 2y ago
[dead]
blackeyeblitzar 2y ago
The market correctly does not care because there is no consequence for the current or prior executives and no financial consequence for the company. All they will do is send out some obligatory notices, mention it in their investor relation materials, maybe offer a year of credit score monitoring, and move on. We need regulations with massive fines, class action lawsuits (a ban on arbitration clauses), and maybe automatic minimum level compensation to those customers.

smcin 2y ago

They are very much related to the news, that's precisely why I linked to the stock charts: AT&T was flat overnight but opened (9am ET) with a -2.6% spike down, but has been recovering since. Their press release appears to have been Friday 7am ET shortly before market open [https://about.att.com/story/2024/addressing-illegal-download.html https://about.att.com/story/2024/addressing-illegal-download...]. Also as corroboration here's MarketWatch: "AT&T’s stock slides 3% after company discloses hack of calls and texts" [https://www.marketwatch.com/story/at-ts-stock-slides-2-9-after-company-discloses-hack-of-calls-and-texts-908a5fa1 https://www.marketwatch.com/story/at-ts-stock-slides-2-9-aft...]

soulofmischief 2y ago
I'm not saying there's no way the stock pullback wasn't caused by the hack, but it's also important to note that MarketWatch article only establishes correlation, not causation.
- seadan83 2y ago
  Most linked financial news is auto-generated and auto-correlated. Lots of "why did.." when nobody knows, and frankly there often is no why. Perhaps that was the day a retirement fund shifted money, who knows. While this price movement is very well correlated, perhaps causal even, but marketwatch (and all similar bottom feeders that are just trying to make ad revenue), it's a case of a broken clock being right. Those financial news sites which link recent news to stocks, eg Yahoo, benzings, - those recent news headlines are just the same as ad tech now. It is noise.

graybeardhacker 2y ago

I agree. This is precisely why breaches keep happening and will keep happening. It cost money to implement security. There's no cost benefit to spending that time and money since there are no consequences. Businesses do not spend money unless it will make them money or save them money. There needs to be a hefty federal fine on a per-affected-user basis for data breaches. Also a federal fine for each day a breach is unreported. That money should go into a pool which can be accessed by people who have their identity stolen.

ThunderSizzle 2y ago
Or a lawsuit go through where someone can win quite a bit from from data leaks. If each person affected sued and won 100k or so, or even 1k, AT&T would definitely be spending money on security. But it appears $5 or credit monitoring from an agency that also gets hacked is sufficient for class action lawsuits.
- malcolmgreaves 2y ago
  That requires people to be rich enough to sue. It takes a lot of money and time to sue. Almost no one has enough resources to do this. The courts are not an effective way to implement this policy. Unless you only want rich people to be able to get justice.
  - CityOfThrowaway 2y ago
    110M people impacted = class action The lawyers work on contingency
    - unixhero 2y ago
      Imagine the GDPR fine
      - BrandoElFollito 2y ago
        Up to 4% of income. This is not the end of the world either.

chung8123 2y ago

I think they will care a lot more when it directly impacts them. If all their text conversations were publicly available that would cause some outrage.

rybosworld 2y ago

There is some evidence that it does hurt stock prices: https://www.comparitech.com/blog/information-security/data-breach-share-price-analysis/ https://www.comparitech.com/blog/information-security/data-b... "Stocks of breached companies on average underperformed the NASDAQ by -3.2% in the six months after a breach disclosure" That said, it's not clear what the long term impact is on stock price (if there is any).

teraflop 2y ago
Unfortunately, that analysis seems to have made absolutely no attempt to check whether the results are statistically significant. Pick 118 random companies at 118 random points in time. It's vanishingly unlikely that the average returns of that group will exactly track the NASDAQ returns over the following 60 days. It might underperform, or it might overperform. An underperformance of 3.2% could easily just be the result of random chance, and have nothing to do with data breaches.
- jkaptur 2y ago
  My hypothesis would be that companies with poor operational practices are more likely to underperform the index and have data breaches - in other words, that the study confuses cause and effect. This wouldn't be that hard to test. I suspect that the breached companies underperformed in the six months before the breach as well as the six months after.
  - Terr_ 2y ago
    Also, events which are not "just" data-leaks but also interruptions or degradation in regular operations. I suspect investors may be more sensitive to those events and their fallout, and such events more likely to either be caused by bad-practice or to be somehow connected to data-leaks.

weezin 2y ago

Really should be up to the government to fine these companies and pay out to those effected to disincentivize lax security standards.

kcmastrpc 2y ago
How would such damages be assessed or proven?
- Eisenstein 2y ago
  They would be assessed according to rules written by people who are skilled at writing such rules. The rules would be evaluated by looking at data over time and revised as needed by experts in the industry who are as neutral as possible, maybe with some feedback from the public. The courts exist for any contention regarding responsibility.
hodgesrm 2y ago
Well, I guess we devs should also be looking at ourselves, then. A lot of the lax security comes from us collectively choosing to build applications using cloud services that talk to each other over the public internet. That pretty much describes the so-called "modern data stack."

nashashmi 2y ago

Insurance takes up a lot of the fallout from data breaches.

darby_nine 2y ago

I'm certainly not going to defend negligence of data protection but it's extremely difficult to cost as a liability (naively, you might even consider it not a liability at all) without government oversight.

hodgesrm 2y ago

> I never got the impression that the market ever cares about data breaches. It seems most companies are rarely held financially responsible for data breaches anyway. This might also explain why there's little visible effect on other cloud database services either. After all, the attack is pretty simple and potentially affects any cloud database that allows access from the Internet.

deleted 2y ago

[deleted]

omoikane 2y ago

My reading is that the market thinks Snowflake takes the majority of the blame, and the content of the linked article seemed to suggest as much despite having only AT&T in the headline.

lp0_on_fire 2y ago

The market doesn't care precisely because there is never any accountability.

Vicinity9635 2y ago

[dead]

blackeyeblitzar 2y ago

The market correctly does not care because there is no consequence for the current or prior executives and no financial consequence for the company. All they will do is send out some obligatory notices, mention it in their investor relation materials, maybe offer a year of credit score monitoring, and move on. We need regulations with massive fines, class action lawsuits (a ban on arbitration clauses), and maybe automatic minimum level compensation to those customers.