5 ms·

I wouldn't be so quick. Everybody gets hacked, sooner or later. Whether they'll own up to it or not is what makes the difference and I've seen far, far worse th

I wouldn't be so quick. Everybody gets hacked, sooner or later. Whether they'll own up to it or not is what makes the difference and I've seen far, far worse than this response by Checkout.com, it seems to be one of the better responses to such an event that I've seen to date. > Like, how many other deprecated third party systems were identified handling a significant portion of your customer data after this hack? The problem with that is that you'll never know. Because you'd have to audit each and every service provider and I think only Ebay does that. And they're not exactly a paragon of virtue either. > Who declined to allocate the necessary budget to keep systems updated? See: prevention paradox. Until this sinks in it will happen over and over again. > But mere words like these are absolutely meaningless in today's world. People are right to dismiss them. Again, yes, but: they are at least attempting to use the right words. Now they need to follow them up with the right actions.

sharken 1y ago
Well said, ideally action comes first and then these actions can be communicated. But in the real world, you have words ie. commitment before actions and a conclusion. Best of luck to them.
BoredPositron 1y ago
There are millions of companies even century or decade old ones without a hacking incident with data extraction. The whole everyone gets hacked is copium for a lack of security standards or here the lack of deprecation and having unmantained systems online with legacy client data. Announcing it proudly would be concerning if I had business with them. It's not even a lack of competence... it's a lack of hygiene.
- bragr 1y ago
  >There are millions of companies even century or decade old ones without a hacking incident with data extraction. Name five.
  - Retric 1y ago
    The pedantic answer is to point to a bunch of shell companies without any electronic presence. However in terms of actual businesses there’s decent odds the closest dry cleaners, independent restaurant, car wash, etc has not had its data extracted by a hacking incident. Having a minimal attack surface and not being actively targeted is a meaningful advantage here.
    - bragr 1y ago
      >there’s decent odds the closest dry cleaners, independent restaurant, car wash, etc has not had its data extracted by a hacking incident. And there's also a decent chance they have. Did we not just have a years long spate of ransomware targeting small businesses?
      - Retric 1y ago
        Most ransomeware isn’t exfiltrating data. For small business you can automate the ‘pay to unencrypt your HDD’ model easy without care for what’s on the disk.
  - udev4096 1y ago
    There are definitely companies who have never been breached and it's not that hard. Defense in depth is all you need
    - RealityVoid 1y ago
      Isn't defense in depth's whole point that some of your defenses will get breached?
      - BoredPositron 1y ago
        Take the OP. What defenses were breached? An old abandoned system running unmantained in the background with old user data still attached. There is no excuse.
benchly 1y ago
> Everybody gets hacked, sooner or later. Right! But, wouldn't a more appropriate approach be to mitigate the damage from being hacked as much as possible in the first place? Perhaps this starts by simplifying bloated systems, reducing data collection to data that which is only absolutely legally necessary for KYC and financial transactions in whatever respective country(ies) the service operates in, hammer-testing databases for old tricks that seem to have been forgotten about in a landscape of hacks with ever-increasingly complexity, etc. Maybe it's the dad in me, years of telling me son to not apologize, but to avoid the behavior that causes the problem in the first place. Bad things happen, and we all screw up from time to time, that is a fact of life, but a little forethought and consideration about the best or safest way to do a thing is a great way to shrink the blast area of any surprise bombs that go off.
- grayson-st 1y ago
  [dead]
- ummonk 1y ago
  I don’t see how any of what you’re suggesting would have prevented this hack though (which involved an old storage account that hadn’t been used since 2020 getting hacked).
  - benchly 1y ago
    You don't see how preventative maintenance such as implementing a policy to remove old accounts after N days could have prevented this? Preventative maintenance is part of the forethought that should take place about the best or safest way to do a thing. This is something that could be easily learned by looking an problems others have had in the past. As a controls tech, I provide a lot of documentation and teach to our customers about how to deploy, operate and maintain a machine for best possible results with lowest risk to production or human safety. Some clients follow my instruction, some do not. Guess which ones end up getting billed most for my time after they've implemented a product we make. Too often, we want to just do without thinking. This often causes us to overlook critical points of failure.
kbrkbr 1y ago
I like your stance. We also have to remember that we have collectively decided to use Windows and AD, QA tested software etc (some examples) over correct software, hardened by default settings etc.
miohtama 1y ago
Not everyone gets hacked. Companies not hacked include e.g. - Google - Amazon - Meta
- ceejayoz 1y ago
  Meta once misconfigured the web servers and exposed the source. https://techcrunch.com/2007/08/11/facebook-source-code-leaked/ https://techcrunch.com/2007/08/11/facebook-source-code-leake...
- lr4444lr 1y ago
  ... that we know of. Perhaps some of those "outages" were compromised systems.
  - red-iron-pine 1y ago
    "shit it's compromised. pull the plug ASAP"
    - cindyllm 1y ago
      [dead]
- sigmoid10 1y ago
  The relevant difference here is that these companies have actual security standards on the level that you would only find in the FAA or similar organisations were lives are in danger. For every incident in Google cloud for example, they don't just apologise, but they state exactly what happened and how they responded (down to the minute) and you can read up exactly how they plan to prevent this from happening again: https://status.cloud.google.com/incidents/ow5i3PPK96RduMcb1SsW https://status.cloud.google.com/incidents/ow5i3PPK96RduMcb1S... This is what incident handling by a trustworthy provider looks like.
- dragoncrab 1y ago
  Google just got hacked in June: https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion https://cloud.google.com/blog/topics/threat-intelligence/voi... https://www.forbes.com/sites/daveywinder/2025/08/09/google-confirms-it-has-been-hacked---user-data-stolen/ https://www.forbes.com/sites/daveywinder/2025/08/09/google-c...
adrianN 1y ago
The prevention paradox only really applies when the bad event has significant costs. It seems to me that getting hacked has at worst mild consequences. Cisco for example is still doing well despite numerous embarrassing backdoors.
throwaway2037 1y ago
I like this post. No matter how/when/where/why someone apologizes for a mistake on the Internet, there will always be an "Armchair Quarterback" (on HN) that says: "Oh, that's not a _real_ apology; if I were CEO/CTO/CIO, I would do X/Y/Z to prevent this issue." It feels like a version of "No True Scotsman". <rolls eyes> I feel like most of these people will never be senior managers at a tech company because they will "go broke" trying to prevent every last mistake, instead of creating a beautiful product that customers are desperate to buy! My father once said to me as a young person: "Don't insure yourself 'to death' (bankruptcy)." To say: You need to take some risk in life as a person, especially in business. To be clear: I am not advocating that business people be lazy about computer security. Rather, there is a reasonable limit to their efforts. You wrote: > Everybody gets hacked, sooner or later. I mostly agree. However, I do not understand how GMail is not hacked more often. Literally, I have not changed my Google password in ~10 years, and my GMail is still untouched. (Falls on sword...) How do they do it? Honestly: No trolling with my question! Does Google get hacked but they keep it a secret? They must be the target of near-constant "nation state"-level hacking programmes.
- lmz 1y ago
  > Literally, I have not changed my Google password in ~10 years, and my GMail is still untouched. The flip side of this is how many people are wrongly locked out of their gmail. I bet there's quite a few of them that failed to satisfy whatever filters Google put in place.
- rixed 1y ago
  > How do they do it? To begin with, they have a culture of not following "industry standards". (For the reason that the industry never had this scale yet)

sharken 1y ago

Well said, ideally action comes first and then these actions can be communicated. But in the real world, you have words ie. commitment before actions and a conclusion. Best of luck to them.

BoredPositron 1y ago

There are millions of companies even century or decade old ones without a hacking incident with data extraction. The whole everyone gets hacked is copium for a lack of security standards or here the lack of deprecation and having unmantained systems online with legacy client data. Announcing it proudly would be concerning if I had business with them. It's not even a lack of competence... it's a lack of hygiene.

bragr 1y ago
>There are millions of companies even century or decade old ones without a hacking incident with data extraction. Name five.
- Retric 1y ago
  The pedantic answer is to point to a bunch of shell companies without any electronic presence. However in terms of actual businesses there’s decent odds the closest dry cleaners, independent restaurant, car wash, etc has not had its data extracted by a hacking incident. Having a minimal attack surface and not being actively targeted is a meaningful advantage here.
  - bragr 1y ago
    >there’s decent odds the closest dry cleaners, independent restaurant, car wash, etc has not had its data extracted by a hacking incident. And there's also a decent chance they have. Did we not just have a years long spate of ransomware targeting small businesses?
    - Retric 1y ago
      Most ransomeware isn’t exfiltrating data. For small business you can automate the ‘pay to unencrypt your HDD’ model easy without care for what’s on the disk.
- udev4096 1y ago
  There are definitely companies who have never been breached and it's not that hard. Defense in depth is all you need
  - RealityVoid 1y ago
    Isn't defense in depth's whole point that some of your defenses will get breached?
    - BoredPositron 1y ago
      Take the OP. What defenses were breached? An old abandoned system running unmantained in the background with old user data still attached. There is no excuse.

benchly 1y ago

> Everybody gets hacked, sooner or later. Right! But, wouldn't a more appropriate approach be to mitigate the damage from being hacked as much as possible in the first place? Perhaps this starts by simplifying bloated systems, reducing data collection to data that which is only absolutely legally necessary for KYC and financial transactions in whatever respective country(ies) the service operates in, hammer-testing databases for old tricks that seem to have been forgotten about in a landscape of hacks with ever-increasingly complexity, etc. Maybe it's the dad in me, years of telling me son to not apologize, but to avoid the behavior that causes the problem in the first place. Bad things happen, and we all screw up from time to time, that is a fact of life, but a little forethought and consideration about the best or safest way to do a thing is a great way to shrink the blast area of any surprise bombs that go off.

grayson-st 1y ago
[dead]
ummonk 1y ago
I don’t see how any of what you’re suggesting would have prevented this hack though (which involved an old storage account that hadn’t been used since 2020 getting hacked).
- benchly 1y ago
  You don't see how preventative maintenance such as implementing a policy to remove old accounts after N days could have prevented this? Preventative maintenance is part of the forethought that should take place about the best or safest way to do a thing. This is something that could be easily learned by looking an problems others have had in the past. As a controls tech, I provide a lot of documentation and teach to our customers about how to deploy, operate and maintain a machine for best possible results with lowest risk to production or human safety. Some clients follow my instruction, some do not. Guess which ones end up getting billed most for my time after they've implemented a product we make. Too often, we want to just do without thinking. This often causes us to overlook critical points of failure.

kbrkbr 1y ago

I like your stance. We also have to remember that we have collectively decided to use Windows and AD, QA tested software etc (some examples) over correct software, hardened by default settings etc.

miohtama 1y ago

Not everyone gets hacked. Companies not hacked include e.g. - Google - Amazon - Meta

ceejayoz 1y ago
Meta once misconfigured the web servers and exposed the source. https://techcrunch.com/2007/08/11/facebook-source-code-leaked/ https://techcrunch.com/2007/08/11/facebook-source-code-leake...
lr4444lr 1y ago
... that we know of. Perhaps some of those "outages" were compromised systems.
- red-iron-pine 1y ago
  "shit it's compromised. pull the plug ASAP"
  - cindyllm 1y ago
    [dead]
sigmoid10 1y ago
The relevant difference here is that these companies have actual security standards on the level that you would only find in the FAA or similar organisations were lives are in danger. For every incident in Google cloud for example, they don't just apologise, but they state exactly what happened and how they responded (down to the minute) and you can read up exactly how they plan to prevent this from happening again: https://status.cloud.google.com/incidents/ow5i3PPK96RduMcb1SsW https://status.cloud.google.com/incidents/ow5i3PPK96RduMcb1S... This is what incident handling by a trustworthy provider looks like.
dragoncrab 1y ago
Google just got hacked in June: https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion https://cloud.google.com/blog/topics/threat-intelligence/voi... https://www.forbes.com/sites/daveywinder/2025/08/09/google-confirms-it-has-been-hacked---user-data-stolen/ https://www.forbes.com/sites/daveywinder/2025/08/09/google-c...

adrianN 1y ago

The prevention paradox only really applies when the bad event has significant costs. It seems to me that getting hacked has at worst mild consequences. Cisco for example is still doing well despite numerous embarrassing backdoors.

throwaway2037 1y ago

I like this post. No matter how/when/where/why someone apologizes for a mistake on the Internet, there will always be an "Armchair Quarterback" (on HN) that says: "Oh, that's not a _real_ apology; if I were CEO/CTO/CIO, I would do X/Y/Z to prevent this issue." It feels like a version of "No True Scotsman". <rolls eyes> I feel like most of these people will never be senior managers at a tech company because they will "go broke" trying to prevent every last mistake, instead of creating a beautiful product that customers are desperate to buy! My father once said to me as a young person: "Don't insure yourself 'to death' (bankruptcy)." To say: You need to take some risk in life as a person, especially in business. To be clear: I am not advocating that business people be lazy about computer security. Rather, there is a reasonable limit to their efforts. You wrote: > Everybody gets hacked, sooner or later. I mostly agree. However, I do not understand how GMail is not hacked more often. Literally, I have not changed my Google password in ~10 years, and my GMail is still untouched. (Falls on sword...) How do they do it? Honestly: No trolling with my question! Does Google get hacked but they keep it a secret? They must be the target of near-constant "nation state"-level hacking programmes.

lmz 1y ago
> Literally, I have not changed my Google password in ~10 years, and my GMail is still untouched. The flip side of this is how many people are wrongly locked out of their gmail. I bet there's quite a few of them that failed to satisfy whatever filters Google put in place.
rixed 1y ago
> How do they do it? To begin with, they have a culture of not following "industry standards". (For the reason that the industry never had this scale yet)