Online Security

[Joey Shabadoo]

With news that another organisation has been hacked and personal details lost, is it time to start fining companies that suffer such lapses in security? Maybe a financial guarantee per user?

http://www.bbc.com/news/technology-41286638

Or does this already happen? All I seem to get (not with this example) is a mealy-mouthed apology.

 

[numbnuts]

If you have the very best security someone somewhere will try to crack it, nothing today is foolproof.

 

[Levo-Lon]

Nice thing about Equifax being hacked is the fraudsters will at least know if the scammed individual can pay the scam

 

[bruce1530]

Under current data protection laws, the UK Information Commissioner can issue fines of up to half a million pounds for a data breach. In practice, they have never issued a fine grater than 400k.

GDPR regulations, which come into effect next year, have more clout. The basic principles are not unlike the current data protection regulations, but the fines can be up to 20 million euros, or 4% of global annual turnover.


The company that was fined 400k (TalkTalk) also lost a significant proportion of its customer base, it’s profits halved, share price tumbled, and it spent around 40 million “recovering” from the attack. So the fine is pretty insignificant.

 

[classic33]

Indeed & Reed were hit in June-July. Again.

 

[twentysix by twentyfive]

How do I know if my (personal) details have been stolen?

 

[classic33]

How do I know if my (personal) details have been stolen?

Normally you'll never know, unless something goes wrong.

Right this minute there could be another "you" walking round somewhere.

 

[twentysix by twentyfive]

Normally you'll never know, unless something goes wrong.

Right this minute there could be another "you" walking round somewhere.

Hmmph - sounds a bit multiverse to me. I'll have a word with Stephen (Hawking)

 

[classic33]

Hmmph - sounds a bit multiverse to me. I'll have a word with Stephen (Hawking)

Name, address, date of birth, anything else after that is just making it too easy for them.

 

[bruce1530]

How do I know if my (personal) details have been stolen?

You can check if your details were included in many breaches by searching for your email on https://haveibeenpwned.com

 

[twentysix by twentyfive]

You can check if your details were included in many breaches by searching for your email on https://haveibeenpwned.com

But is that site safe? If I type in my email................. ?

 

[bruce1530]

But is that site safe? If I type in my email................. ?

As they say in their FAQ - if you don’t trust it, don’t use it. :-)


But Troy Hunt, the site owner, is well respected in the info security world. Here’s what moneysavingexpert.com says about it... http://www.moneysavingexpert.com/ne...now-if-hackers-have-stolen-your-personal-info

 

[Andy_R]

With news that another organisation has been hacked and personal details lost, is it time to start fining companies that suffer such lapses in security? Maybe a financial guarantee per user?

http://www.bbc.com/news/technology-41286638

Or does this already happen? All I seem to get (not with this example) is a mealy-mouthed apology.

In real world terms, the fine is that people/businesses/corporations/banks stop using their services. In order to stay in business they know they have to remain secure and will ramp up their efforts to do so. Otherwise they lose business and go under.

 

[Dan B]

In real world terms, the fine is that people/businesses/corporations/banks stop using their services. In order to stay in business they know they have to remain secure and will ramp up their efforts to do so. Otherwise they lose business and go under.

If it were possible to opt out of appearing in credit reference agency's files, then sure, this would be an option. But in the real world i doubt the various lenders, landlords, etc, who use Equifax to check whether you're a bad credit risk care overmuch whether they have let all your data get stolen

 

[Tim Hall]

If you have the very best security someone somewhere will try to crack it, nothing today is foolproof.

According to Money Box today on Radio 4 , if Equifax had bothered to apply a security patch they'd been issued this breach wouldn't have happened. Googling for Apache Struts (the package in question) says the patch was released in March. Equifax got hit in May. That doesn't sound very clever.