7 ms·

I'll never not think of that South Park scene where they mocked BP's "We're so sorry" statement whenever I see one of those. I don't care if you're sorry or if

I'll never not think of that South Park scene where they mocked BP's "We're so sorry" statement whenever I see one of those. I don't care if you're sorry or if you realize how much you betrayed your customers. Tell me how you investigated the root causes of the incident and how the results will prevent this scenario from ever happening again. Like, how many other deprecated third party systems were identified handling a significant portion of your customer data after this hack? Who declined to allocate the necessary budget to keep systems updated? That's the only way I will even consider giving some trust back. If you really want to apologise, start handing out cash or whatever to the people you betrayed. But mere words like these are absolutely meaningless in today's world. People are right to dismiss them.

YetAnotherNick 1y ago
Right. Transparency doesn't mean telling about the attack that already happened. It means telling us about their issues and ways this could happen again. And they didn't even mention the investment amount for the security labs.
jacquesm 1y ago
I wouldn't be so quick. Everybody gets hacked, sooner or later. Whether they'll own up to it or not is what makes the difference and I've seen far, far worse than this response by Checkout.com, it seems to be one of the better responses to such an event that I've seen to date. > Like, how many other deprecated third party systems were identified handling a significant portion of your customer data after this hack? The problem with that is that you'll never know. Because you'd have to audit each and every service provider and I think only Ebay does that. And they're not exactly a paragon of virtue either. > Who declined to allocate the necessary budget to keep systems updated? See: prevention paradox. Until this sinks in it will happen over and over again. > But mere words like these are absolutely meaningless in today's world. People are right to dismiss them. Again, yes, but: they are at least attempting to use the right words. Now they need to follow them up with the right actions.
- sharken 1y ago
  Well said, ideally action comes first and then these actions can be communicated. But in the real world, you have words ie. commitment before actions and a conclusion. Best of luck to them.
- BoredPositron 1y ago
  There are millions of companies even century or decade old ones without a hacking incident with data extraction. The whole everyone gets hacked is copium for a lack of security standards or here the lack of deprecation and having unmantained systems online with legacy client data. Announcing it proudly would be concerning if I had business with them. It's not even a lack of competence... it's a lack of hygiene.
  - bragr 1y ago
    >There are millions of companies even century or decade old ones without a hacking incident with data extraction. Name five.
    - Retric 1y ago
      The pedantic answer is to point to a bunch of shell companies without any electronic presence. However in terms of actual businesses there’s decent odds the closest dry cleaners, independent restaurant, car wash, etc has not had its data extracted by a hacking incident. Having a minimal attack surface and not being actively targeted is a meaningful advantage here.
      - bragr 1y ago
        >there’s decent odds the closest dry cleaners, independent restaurant, car wash, etc has not had its data extracted by a hacking incident. And there's also a decent chance they have. Did we not just have a years long spate of ransomware targeting small businesses?
        Retric 1y ago
pembrook 1y ago
In attacks on software systems specifically though, I always find this aggressive stance toward the victimized business odd, especially when otherwise reasonable security standards have been met. You simply cannot plug all holes. As AI tools accelerate hacking capabilities, at what point do we seriously start going after the attackers across borders and stop blaming the victimized businesses? We solved this in the past. Let’s say you ran a brick-and-mortar business, and even though you secured your sensitive customer paperwork in a locked safe (which most probably didn’t), someone broke into the building and cracked the safe with industrial-grade drilling equipment. You would rightly focus your ire and efforts on the perpetrators, and not say ”gahhh what an evil dumb business, you didn’t think to install a safe of at least 1 meter thick titanium to protect against industrial grade drilling!????” If we want to have nice things going forward, the solution is going to have to involve much more aggressive cybercrime enforcement globally. If 100,000 North Koreans landed on the shores of Los Angeles and began looting en masse, the solution would not be to have everybody build medieval stone fortresses around their homes.
josfredo 1y ago
No trolling on my side, I think having people who think just like you is a triumph for humanity. As we approach times far darker and manipulation takes smarter shapes, a cynical mind is worth many trophies.
ema 1y ago
> prevent this scenario from ever happening again. Every additional nine of not getting hacked takes effort. Getting to 100% takes infinite effort i.e. is impossible. Trying to achieve the impossible will make you spin on the spot chasing ever more obscure solutions. As soon as you understand a potential solution enough to implement it you also understand that it cannot achieve the impossible. If you keep insisting on achieving the impossible you have to abandon this potential solution and pin your hope on something you don't understand yet. And so the cycle repeats. It is good to hold people accountable but only demand the impossible from those you want to go crazy.
- stellas9099 1y ago
  [dead]
bargainbin 1y ago
The intent of the South Park sketch was to lampoon that BP were (/are) willingly doing awful things and then give corpo apology statements when caught. Here, Checkout has been the victim of a crime, just as much as their impacted customers. It’s a loss for everyone involved except the perpetrators. Using words like “betrayed” as if Checkout wilfully mislead its customers, is a heavy accusation to level. At a point, all you can do is apologise, offer compensation if possible, and plot out how you’re going to prevent it going forward.
- ImPostingOnHN 1y ago
  > At a point, all you can do is apologise, offer compensation if possible, and plot out how you’re going to prevent it going forward. I totally agree – You've covered the 3 most important things to do here: Apologize; make it right; sufficiently explain in detail to customers how you'll prevent recurrences. After reading the post, I see the 1st of 3. To their credit, most companies don't get that far, so thanks, Checkout.com. Now keep going, 2 tasks left to do and be totally transparent about.
gosub100 1y ago
What you request is for them to divulge internal details of their architecture that could lead to additional compromise as well as admission of fault that could make it easier for them to be sued. All for some intangible moral notion. No business leader would ever do those things.
saulpw 1y ago
They are donating the entire ransom amount to two universities for security research. I don't care about the words themselves, but assuming they're not outright lying about this, that meant a lot to me. They are putting their (corporate!) money where their mouth is.
renewiltord 1y ago
Haha, yes, this is entirely what I expected. I was actually pleasantly surprised by the GP because internet commentators always find a reason that some statement is imperfect. Indeed, an apology is bad and no apology is also bad. In fact, all things are bad. Haha! Absolutely prime.
stronglikedan 1y ago
Can't please everybody all the time, so best to focus on the majority.

YetAnotherNick 1y ago

Right. Transparency doesn't mean telling about the attack that already happened. It means telling us about their issues and ways this could happen again. And they didn't even mention the investment amount for the security labs.

jacquesm 1y ago

I wouldn't be so quick. Everybody gets hacked, sooner or later. Whether they'll own up to it or not is what makes the difference and I've seen far, far worse than this response by Checkout.com, it seems to be one of the better responses to such an event that I've seen to date. > Like, how many other deprecated third party systems were identified handling a significant portion of your customer data after this hack? The problem with that is that you'll never know. Because you'd have to audit each and every service provider and I think only Ebay does that. And they're not exactly a paragon of virtue either. > Who declined to allocate the necessary budget to keep systems updated? See: prevention paradox. Until this sinks in it will happen over and over again. > But mere words like these are absolutely meaningless in today's world. People are right to dismiss them. Again, yes, but: they are at least attempting to use the right words. Now they need to follow them up with the right actions.

sharken 1y ago
Well said, ideally action comes first and then these actions can be communicated. But in the real world, you have words ie. commitment before actions and a conclusion. Best of luck to them.
BoredPositron 1y ago
There are millions of companies even century or decade old ones without a hacking incident with data extraction. The whole everyone gets hacked is copium for a lack of security standards or here the lack of deprecation and having unmantained systems online with legacy client data. Announcing it proudly would be concerning if I had business with them. It's not even a lack of competence... it's a lack of hygiene.
- bragr 1y ago
  >There are millions of companies even century or decade old ones without a hacking incident with data extraction. Name five.
  - Retric 1y ago
    The pedantic answer is to point to a bunch of shell companies without any electronic presence. However in terms of actual businesses there’s decent odds the closest dry cleaners, independent restaurant, car wash, etc has not had its data extracted by a hacking incident. Having a minimal attack surface and not being actively targeted is a meaningful advantage here.
    - bragr 1y ago
      >there’s decent odds the closest dry cleaners, independent restaurant, car wash, etc has not had its data extracted by a hacking incident. And there's also a decent chance they have. Did we not just have a years long spate of ransomware targeting small businesses?
      - Retric 1y ago

pembrook 1y ago

In attacks on software systems specifically though, I always find this aggressive stance toward the victimized business odd, especially when otherwise reasonable security standards have been met. You simply cannot plug all holes. As AI tools accelerate hacking capabilities, at what point do we seriously start going after the attackers across borders and stop blaming the victimized businesses? We solved this in the past. Let’s say you ran a brick-and-mortar business, and even though you secured your sensitive customer paperwork in a locked safe (which most probably didn’t), someone broke into the building and cracked the safe with industrial-grade drilling equipment. You would rightly focus your ire and efforts on the perpetrators, and not say ”gahhh what an evil dumb business, you didn’t think to install a safe of at least 1 meter thick titanium to protect against industrial grade drilling!????” If we want to have nice things going forward, the solution is going to have to involve much more aggressive cybercrime enforcement globally. If 100,000 North Koreans landed on the shores of Los Angeles and began looting en masse, the solution would not be to have everybody build medieval stone fortresses around their homes.

josfredo 1y ago

No trolling on my side, I think having people who think just like you is a triumph for humanity. As we approach times far darker and manipulation takes smarter shapes, a cynical mind is worth many trophies.

ema 1y ago

> prevent this scenario from ever happening again. Every additional nine of not getting hacked takes effort. Getting to 100% takes infinite effort i.e. is impossible. Trying to achieve the impossible will make you spin on the spot chasing ever more obscure solutions. As soon as you understand a potential solution enough to implement it you also understand that it cannot achieve the impossible. If you keep insisting on achieving the impossible you have to abandon this potential solution and pin your hope on something you don't understand yet. And so the cycle repeats. It is good to hold people accountable but only demand the impossible from those you want to go crazy.

stellas9099 1y ago
[dead]

bargainbin 1y ago

The intent of the South Park sketch was to lampoon that BP were (/are) willingly doing awful things and then give corpo apology statements when caught. Here, Checkout has been the victim of a crime, just as much as their impacted customers. It’s a loss for everyone involved except the perpetrators. Using words like “betrayed” as if Checkout wilfully mislead its customers, is a heavy accusation to level. At a point, all you can do is apologise, offer compensation if possible, and plot out how you’re going to prevent it going forward.

ImPostingOnHN 1y ago
> At a point, all you can do is apologise, offer compensation if possible, and plot out how you’re going to prevent it going forward. I totally agree – You've covered the 3 most important things to do here: Apologize; make it right; sufficiently explain in detail to customers how you'll prevent recurrences. After reading the post, I see the 1st of 3. To their credit, most companies don't get that far, so thanks, Checkout.com. Now keep going, 2 tasks left to do and be totally transparent about.

gosub100 1y ago

What you request is for them to divulge internal details of their architecture that could lead to additional compromise as well as admission of fault that could make it easier for them to be sued. All for some intangible moral notion. No business leader would ever do those things.

saulpw 1y ago

They are donating the entire ransom amount to two universities for security research. I don't care about the words themselves, but assuming they're not outright lying about this, that meant a lot to me. They are putting their (corporate!) money where their mouth is.

renewiltord 1y ago

Haha, yes, this is entirely what I expected. I was actually pleasantly surprised by the GP because internet commentators always find a reason that some statement is imperfect. Indeed, an apology is bad and no apology is also bad. In fact, all things are bad. Haha! Absolutely prime.

stronglikedan 1y ago

Can't please everybody all the time, so best to focus on the majority.