[HN Gopher] Allianz Life says 'majority' of customers' personal ...
       ___________________________________________________________________
        
       Allianz Life says 'majority' of customers' personal data stolen in
       cyberattack
        
       Author : thm
       Score  : 168 points
       Date   : 2025-07-27 17:49 UTC (5 hours ago)
        
 (HTM) web link (techcrunch.com)
 (TXT) w3m dump (techcrunch.com)
        
       | SoftTalker wrote:
       | Yawn. Another day, another breach.
       | 
       | Our industry is pathetic.
        
         | Rotundo wrote:
         | This will continue until there are serious repercussions for a
         | company.
        
           | SoftTalker wrote:
           | Unclear who is responsible here, Allianz or their third party
           | "cloud-based CRM provider."
           | 
           | But I think that fundamentally, secure cloud-based SaaS is
           | impossible. This stuff needs to be on-prem and airgapped from
           | the internet. That makes some functionality complicated or
           | impossible, but we're seeing that what we have now is not
           | working.
        
             | nothercastle wrote:
             | Buck stops at Allianz but the 3rd party might share some of
             | the minuscule cost of bullshit identity protection services
        
             | filleokus wrote:
             | Allianz have more than 150k employees with offices in 50+
             | countries. Not all of them need access to the CRM of
             | course, but I think going back to on-prem is just asking
             | for different kind of trouble.
             | 
             | We don't have any details now, but I wouldn't be surprised
             | if the cloud-based CRM provider didn't have a very
             | technical interesting weakness, but rather that some kind
             | of social engineeringy method was used.
             | 
             | If global companies like this instead had stuff running on-
             | prem all around the world the likelihood of more technical
             | vulnerabilities seems MORE likely to me.
             | 
             | (Air gapping is of course possible, but in my experience,
             | outside of the most security sensitive areas the downsides
             | are simply not acceptable. Or the "air gapping" is just the
             | old "hard shell" / permitter based access-model...)
        
             | mr_mitm wrote:
             | Airgapped means you're transferring data by thumbdrive or
             | CD, which is hugely impractical. You probably meant
             | firewalled.
        
         | BinaryIgor wrote:
         | There are inherent tradeoffs when using centralized solutions
         | like that; unless the company does not use any third-party
         | software and is paranoid about its security - these incidents
         | and breaches will occur, unfortunately.
        
       | slashdev wrote:
       | All these endless data breaches could be reduced if we fixed the
       | incentives, but that's difficult. We could never stop it, because
       | humans make mistakes, and big groups of humans make lots of
       | mistakes. That doesn't mean we shouldn't try.
       | 
       | It seems to me a parallel path that should be pursued is to make
       | the impact less damaging. Don't assume that things like birth
       | dates, names, addresses, phone numbers, emails, SSNs, etc are
       | private. Shut down the avenues that people use to "steal
       | identities".
       | 
       | I hate the term stealing identity, because it implies the victim
       | made some mistake to allow it to happen. When what really
       | happened is the company was lazy to verify that the person
       | they're doing business with is actually who they say they are.
       | The onus and liability should be on the company involved. If a
       | bank gives a loan to you under my name, it should be their
       | problem, not mine. It would go away practically overnight as a
       | problem if that were changed. Companies would be strict about
       | verifying people, because otherwise they'd lose money. Incentives
       | align.
       | 
       | Identify theft is not the only issue with data leaks / breaches,
       | but it seems one of the more tractable.
        
         | DicIfTEx wrote:
         | > I hate the term stealing identity, because it implies the
         | victim made some mistake to allow it to happen. When what
         | really happened is the company was lazy to verify that the
         | person they're doing business with is actually who they say
         | they are. The onus and liability should be on the company
         | involved.
         | 
         | You may enjoy this sketch:
         | https://www.youtube.com/watch?v=CS9ptA3Ya9E
        
           | MichaelZuo wrote:
           | It is really strange that is not already the case.
        
             | Buttons840 wrote:
             | "It's really strange that the status-quo favors those with
             | more wealth and power."
        
           | slashdev wrote:
           | That was hilarious, thanks for sharing!
        
         | JumpCrisscross wrote:
         | > _these endless data breaches could be reduced if we fixed the
         | incentives, but that 's difficult_
         | 
         | It's honestly unclear if the damage from data breaches exceeds
         | the cost of eliminating it. The only case where I see that
         | being clear is in respect of national security.
        
           | AlotOfReading wrote:
           | The more important point is that the people who would have to
           | pay to avoid data breaches (companies) are not the ones who
           | suffer when they happen (the public). It's the same problem
           | as industrial pollution.
        
           | ponector wrote:
           | >> if the damage from data breaches exceeds the cost of
           | eliminating it.
           | 
           | Definitely not. Damage is done to customers but costs to
           | eliminate are on the company. Why should company invest more
           | if there are no meaningful consequences for them?
        
             | JumpCrisscross wrote:
             | > _Definitely not. Damage is done to customers_
             | 
             | What is the evidence for this?
             | 
             | The cost of identity fraud clocks in around $20bn a year
             | [1]. A good fraction of that cost gets picked up (and thus
             | managed) by financial institutions and merchants.
             | 
             | I'm sceptical we could harden our nation's systems for a
             | few billion a year.
             | 
             | [1] https://javelinstrategy.com/research/2024-identity-
             | fraud-stu...
        
         | afarah1 wrote:
         | The solution already exists: MFA and IdP federation.
         | 
         | One factor you know (data) and the other you posess, or you are
         | (biometrics).
         | 
         | IdP issues both factors, identification is federated to them.
         | 
         | Kind of happens when you are required to supply driver's
         | license, which technically you own and is federated id if
         | checked in government system, but can be easily forged with
         | knowledge factors alone.
         | 
         | Unfortunately banks and governments here use facial recognition
         | for the second factor, which has big privacy concerns, and the
         | tendency I think will be federal government as sole IdP. Non-
         | biometroc factors might have practical difficulties at scale,
         | but fingerprint would be better than facial. It's already taken
         | in most countries and could be easily federated. Not perfect
         | but better than the alternatives imo.
        
           | SoftTalker wrote:
           | I'm unconvinced that biometrics are a good approach. You
           | can't change them if a compromise is discovered.
        
             | afarah1 wrote:
             | I also don't like it but it seems to be what most
             | institutions are going for.
             | 
             | It's a strong factor if required in person, the problems
             | start when accepting it remotely. But having to go to the
             | bank seems like the past.
        
           | eptcyka wrote:
           | So what? My data will still get sold online and then
           | agencies/businesses will take advantage of it to do
           | differential pricing. 2fa does not solve the problem of data
           | leaks.
        
       | giantfrog wrote:
       | This will never, ever, ever stop happening until executives start
       | going bankrupt and/or to jail for negligence. Even then it won't
       | stop, but it would at least decrease in frequency and severity.
        
         | SoftTalker wrote:
         | Unless there is willfull negligence (very difficult to prove)
         | or malicious behavior I don't think putting people in jail will
         | help. Most of this stuff happens by accident not by intent.
         | 
         | Financial consequences to the company might be a deterrent, of
         | course then you're dealing with hundreds or thousands of people
         | potentially unemployed because the company was bankrupted by
         | something as simple as a mistake in a firewall somewhere or an
         | employee falling victim to a social engineering trick.
         | 
         | I think the path is along the lines of admitting that cloud,
         | SaaS and other internet-connected information systems cannot be
         | made safe, and dramatically limiting their use.
         | 
         | Or, admitting that a lot of this information should be of no
         | consequence if it is exposed. Imagine a world where knowing my
         | name, SSN, DOB, address, mother's maiden name, and whatever
         | else didn't mean anything.
        
           | fn-mote wrote:
           | > Most of this stuff happens by accident not by intent.
           | 
           | Consider the intent of not hiring enough security staff and
           | supporting them appropriately. It looks a lot like an
           | accident. You could even say it causes accidents.
        
             | SoftTalker wrote:
             | Hiring more people does not prevent the chance of mistakes.
             | It may even increase them. I know places that spend
             | lavishly on security (and employee education w/r/t social
             | engineering, etc.) and have still been breached.
        
               | AlotOfReading wrote:
               | Google and Apple spend lavishly on security and are
               | probably the most heavily attacked companies in the
               | world, often by nation-state adversaries. Yet as far as I
               | can remember, neither has had a successful breach like
               | this in well over a decade.
               | 
               | Clearly it's possible.
        
           | DanHulton wrote:
           | Imagine using this defence with regards to airline crashes.
           | "The crashes happen by accident not by intent" would be a
           | clearly ludicrous defence, as it ought to be here as well.
           | 
           | If we were serious about preventing these kinds of things
           | from happening, we could.
        
             | SoftTalker wrote:
             | If we're OK with regulating SaaS companies (and anyone who
             | connects their information systems to the internet) the way
             | we do the airline industry, that may be an argument.
             | 
             | Bottom line though a good many folks here would loudly
             | resist that kind of oversight on their work and their
             | busineses, and for somewhat valid reasons. Data breaches
             | hardly ever cause hundreds of deaths in a violent fireball.
             | 
             | If the consequences of an airline crash were just some
             | embarassment and some inconvenience for the passengers,
             | they would happen a lot more.
             | 
             | Also people almost never go to jail for airline crashes,
             | even when they cause hundreds of deaths. We investigate
             | them, and maybe issue new regulations, not to punish
             | mistakes, but to try to eliminate the possibilty of them
             | happening again.
        
               | eptcyka wrote:
               | At some point, some US department figured that they can
               | practically budget a human life to cost around 10 million
               | dollars - I wonder if the total amount of lives lost in
               | airline incidents would incur the same amount of money
               | lost as all the fraud that takes place after data
               | breaches like these.
        
               | luckylion wrote:
               | > Data breaches hardly ever cause hundreds of deaths in a
               | violent fireball.
               | 
               | Insurance people will be happy to tell you the price of
               | the average citizen's life. Estimate the total cost to
               | the economy, divide by the average citizen's life-value
               | and you have the statistical deaths caused by this type
               | of incident. Draw a fireball next to it for dramatic
               | effect.
               | 
               | But generally, I don't think _every_ SaaS needs to be
               | tightly regulated. But everyone that handles customer
               | data needs to be. It would also very quickly make them
               | stop hovering up any data they can get their fingers on
               | and instead would make them learn how to provide their
               | services securely without even having access to the data,
               | because having that data suddenly becomes a liability
               | instead of an opportunity.
        
               | aaronmdjones wrote:
               | > We investigate them, and maybe issue new regulations,
               | not to punish mistakes,
               | 
               | This is not quite accurate. In the US for example, the
               | NTSB investigates the causes of an incident, and the FAA
               | carries out any subsequent enforcement action. Whereas
               | the NTSB may rule the cause as pilot error due to
               | negligence for example, the FAA may revoke the pilot's
               | license and/or prosecute them in a civil case to the tune
               | of a hundred thousand dollars and/or refer them to the
               | Department of Justice for criminal prosecution.
        
         | lynx97 wrote:
         | Haha, I still vividly remember how they were trying to make me
         | believe that GDPR is going to a big hammer because it will
         | finally make executives liable for breaches. I silently laughed
         | back then. I am still laughing.
         | 
         | I should probably clarify: There are two types of people that
         | climed that back then. Those trying to gaslight us, and those
         | naiv enough to actually believe the gaslighting. Severe
         | negligence has to be proofen, and that is not easy, and there
         | is a lot of wiggle room in court. Executives being liable for
         | what they did during their term is just not coming, sorry kids.
        
       | BinaryIgor wrote:
       | Well, to some degree it will always happen, no matter how careful
       | the companies are.
       | 
       | Unless it's e2e encrypted (like in Proton Mail or Proton Drive),
       | these incidents will occur. Manage your risk accordingly.
        
         | SoftTalker wrote:
         | At some point it has to be unecrypted to be useful. That's
         | where the vulnerability is.
        
           | BinaryIgor wrote:
           | Depends whether and to what extend your service provider
           | needs it - for Proton, it's always client only decrypted
        
         | mvdtnz wrote:
         | There are very serious drawbacks to e2e encryption that can't
         | be ignored for all use cases. Searching and indexing,
         | reporting, analytics and performance are aspects of a program
         | which become difficult or impossible if all of your data is
         | encrypted everywhere other than the client. It's easy to just
         | wave your hands and say "all data should be e2e encrypted" but
         | it's not that straightforward.
        
           | BinaryIgor wrote:
           | Unfortunately, you're right; I guess there is no easy,
           | handle-it-all answer; it all depends on the specifics of a
           | given system
        
       | jmkni wrote:
       | > "On July 16, 2025, a malicious threat actor gained access to a
       | third-party, cloud-based CRM system used by Allianz Life,"
       | referring to a customer relationship management (CRM) database
       | containing information on its customers.
       | 
       | So who the hell was the "third-party, cloud-based CRM system"?
        
         | MontagFTB wrote:
         | Depending on the CRM, is this not a HIPAA violation?
        
           | marcusb wrote:
           | Why would it be? Is Allianz Life a covered entity? If so, why
           | would it depend on the specific CRM being used?
        
             | tfehring wrote:
             | Allianz Life publishes a HIPAA privacy notice at [0], which
             | states:
             | 
             | > This notice applies to individuals who participate in any
             | of the following programs under the closed line of
             | business:
             | 
             | > * Long term care
             | 
             | > * Medical
             | 
             | > * Medical supplemental
             | 
             | > * Hospital income
             | 
             | > * Cancer and disease specific coverage
             | 
             | > * Dental benefits
             | 
             | > The Covered Entity's actions and obligations are
             | undertaken by Allianz employees as well as the third
             | parties who perform services for the Covered Entity.
             | However, Allianz employees perform only limited Covered
             | Entity functions - most Covered Entity administrative
             | functions are performed by third party service providers.
             | 
             | It sold long term care insurance policies until 2010.
             | 
             | (Disclosure, I happen to have worked at Allianz Life a long
             | time ago, though I have no nonpublic information about any
             | of this.)
             | 
             | [0] https://www.allianzlife.com/-/media/Files/Allianz/PDFs/
             | about...
        
         | milesskorpen wrote:
         | Does it matter? Wasn't a technical breach of their systems, but
         | instead social engineering.
        
           | poemxo wrote:
           | If a cloud-based system doesn't support technologies that
           | deter social engineering, it's still a problem. Some login
           | portals to check your credit history don't even support 2FA.
           | 
           | So I think it matters, I think access systems should be
           | designed with a wider set of human behaviors in mind, and
           | there should be technical hurdles to leaking a majority of
           | customers' personal information.
        
           | politelemon wrote:
           | It matters. That's often a generic phrasing used to make it
           | look like it was a partner's fault. But very often it is
           | simply a platform that was managed by and configured by the
           | company itself, which would mean more than just social
           | engineering. Take a look at the language used in other
           | breaches and it's very similarly veiled.
        
         | ofjcihen wrote:
         | Another article mentioned Salesforce which has a knack for
         | being poorly secured on the data owners side.
         | 
         | I've got another reply here with details but suffice it to say
         | misconfigured Salesforce tenants are all over the internet.
        
           | eclipticplane wrote:
           | Even if SFDC is configured correctly, any sufficiently large
           | or old instance of SFDC may have dozens of other systems
           | plugged into it. Many of which get default access to
           | everything because SFDC security and permission configuration
           | is so byzantine.
        
       | nothercastle wrote:
       | The punishment for poor data security is so low it's not worth
       | paying for it in most companies. And of course the government
       | makes it nearly impossible to change your ssn yet still uses it
       | as a means of verifying so almost everyone is exposed by now.
        
       | rr808 wrote:
       | Kinda frustrating the last few months I've had to upload bank
       | statements and payslips to rent a house and also refinance a
       | mortgage. I know all my financial details are out there floating
       | and invevitably get leaked. I should be able to upload somewhere
       | temporary where these docs are checked then safely deleted.
        
       | fock wrote:
       | I was on the train when some executive support staff joined my
       | car (train ran late and they were easy to find on the internet
       | ...). They behaved like misogynistic ogres and I can vividly
       | imagine those people laugh about this. 0 regard for other people
       | or their societal responsibility.
        
       | time4tea wrote:
       | Mandatory PS1000 fine per record lost. Would be company-terminal
       | for companies with millions of customers - and thats right. Right
       | now it's just cheaper to not care, then send a trite apology
       | email when all the data inevitably gets stolen.
       | 
       | The status quo, nobody gives a crap, with the regulators
       | literally doing nothing, cannot continue. In the UK, the ICO is
       | as effective as Ofwat. (The regulator that was just killed for
       | being pointlessly and dangerously usless)
       | 
       | (Edit: fix autocorrect)
        
         | grapescheesee wrote:
         | Mandatory amount paid directly to the customer of record,
         | instead of fractions of a cent on the dollar, in year long
         | class action settlements might help the disenfranchised
         | 'customers'.
        
         | sunrunner wrote:
         | > Would be company-terminal
         | 
         | What happens to customers of the affected company in this case?
         | Does this not now pass on a second problem to the people
         | actually affected?
        
         | unsupp0rted wrote:
         | Would be national economy terminal too
        
       | sMarsIntruder wrote:
       | Hello KYC
        
       | Buttons840 wrote:
       | I say this often, and it's quite an unpopular idea, and I'm not
       | sure why.
       | 
       | Security researchers, white-hat hackers, and even grey-hat
       | hackers should have strong legal protections so long as they
       | report any security vulnerabilities that they find.
       | 
       | The bad guys are allowed to constantly scan and probe for
       | security vulnerabilities, and there is no system to stop them,
       | but if some good guys try to do the same they are charged with
       | serious felony crimes.
       | 
       | Experience has show we cannot build secure systems. It may be an
       | embarrassing fact, but many, if not all, of our largest companies
       | and organizations are probably completely incapable of building
       | secure systems. I think we try to avoid this fact by not allowing
       | red-team security researches to be on the lookout.
       | 
       | It's funny how everything has worked out for the benefit of
       | companies and powerful organizations. They say "no, you can't
       | test the security of our systems, we are responsible for our own
       | security, you cannot test our security without our permission,
       | and also, if we ever leak data, we aren't responsible".
       | 
       | So, in the end, these powerful organizations are both responsible
       | for their own system security, and yet they also are not
       | responsible, depending on whichever is more convenient at the
       | time. Again, it's funny how it works out that way.
       | 
       | Are companies responsible for their own security, or is this all
       | a big team effort that we're all involved in? Pick a lane. It
       | does feel like we're all involved when half the nation's personal
       | data is leaked every other week.
       | 
       | And this is literally a matter of national security. Is the
       | nation's power grid secure? Maybe? I don't know, do independent
       | organizations verify this? Can I verify this myself by trying to
       | hack the power grid (in a responsible white-hat way)? No, of
       | course not; I would be committing a felony to even try. Enabling
       | powerful organizations to hide their security flaws in their
       | systems, that's the default, they just have to do nothing and
       | then nobody is allowed to research the security of their systems,
       | nobody is allowed to blow the whistle.
       | 
       | We are literally sacrificing national security for the
       | convenience of companies and so they can avoid embarrassment.
        
         | thatguy0900 wrote:
         | I mean, the problem is people will break things. How do you
         | responsibly hack your local electric grid? What if you
         | accidentally mess with something you don't understand, and
         | knock a neighborhood out? How do we prove you just responsibly
         | hacked into a system full of private information then didn't
         | actually look at a bunch of it?
        
           | sunrunner wrote:
           | > How do we prove you just responsibly hacked into a system
           | full of private information then didn't actually look at a
           | bunch of it?
           | 
           | Pinky promise?
        
           | sublinear wrote:
           | If we're strictly talking about software there should be some
           | way to test in a staging environment. Production software
           | that cannot be run this way should be made illegal.
        
         | msgodel wrote:
         | The internet is really a lot like the ocean, things left
         | unmaintained on it are swallowed by waves and sea life.
         | 
         | We need something like the salvage law.
        
         | valianteffort wrote:
         | > Experience has show we cannot build secure systems
         | 
         | It's an unpopular idea because its bullshit. Building secure
         | systems is trivial and at the skill level of a junior engineer.
         | Most of these "hacks" are not elaborate attacks utilizing
         | esoteric knowledge to discover new vectors. They are the same
         | exploit chains targeting bad programming practices, out of date
         | libraries, etc.
         | 
         | Lousy code monkeys or medicore programmers are the ones
         | introducing vulnerabilities. We all know who they are. We all
         | have to deal with them thanks to some brilliant middle manager
         | figuring out how to cut costs for the org.
        
           | KaiserPro wrote:
           | > Building secure systems is trivial
           | 
           | I'd suggest you try and build a secure system for > 150k
           | employees before you make sweeping statements like that.
        
           | tdrz wrote:
           | Sometimes it is the management that doesn't understand
           | anything. In their perspective, security doesn't improve the
           | bottom line.
           | 
           | I worked for an SME that dealt with some sensitive customer
           | data. I mentioned to the CEO that we should invest some time
           | in improving our security. I got back that "what's the big
           | deal, if anyone wants to look they can just look..."
        
           | darzu wrote:
           | Take a broader view of what "building secure systems" means.
           | It's not just about the code being written by ICs but about
           | the business incentives, tech choices of leadership, the
           | individual ways execs are rewarded, legacy realities,
           | interactions with other companies, and a million other
           | things. Our institutions are a complex result of all of these
           | forces. Taken as a whole, and looking at the empirical
           | evidence of companies and agencies frequently leaking data,
           | the conclusion "we cannot build secure systems" is well
           | founded.
        
             | wonderwonder wrote:
             | This is accurate. Especially in shops that implement firm
             | shipping dates for Product Increments. You have X weeks to
             | build Y features consisting of Z tickets. At the end of
             | those X weeks you better have all your tickets done. So
             | more often than not, the tickets are done and the features
             | are implemented. Shops like this build incredible ticket
             | closing machines. They are implemented to pass user
             | acceptance testing not to hold back hackers or bad actors.
             | When leadership incentivizes delivering features and a
             | developers job or raise depends on delivering those
             | features, you get what you incentivize.
        
           | sublinear wrote:
           | This is true, but what's even more interesting is all the
           | things that had to fail long before you had a shop full of
           | monkeys.
        
           | 9dev wrote:
           | That sounds like a perspective from deep in the trenches. A
           | software system has SO many parts, spanning your code, other
           | people's code, open source software, hardware appliances,
           | SaaS tools, office software, email servers, and also humans
           | reachable via social engineering. If someone makes a project
           | manager click a link leading to a fake Jira login, and the
           | attacker uses the credentials to issue a Jira access token,
           | and uses that to impersonate the manager to create an
           | innocuous ticket, and a low-tier developer introduces a
           | subtle change in functionality that opens up a hole... then
           | you have an insecure system.
           | 
           | This story spans a lot of different concerns, only few of
           | which are related to coding skills. Building secure software
           | means defending in breadth, always, not fucking up once,
           | against an armada of bots and creative hackers that only need
           | to get lucky once.
        
           | plst wrote:
           | Looking at the number of already discovered vulnerabilities
           | in popular applications, I would say it's actually impossible
           | to build secure systems right now. Even companies that are
           | trying are failing. IMO it's still way too easy to introduce
           | a vulnerability and then miss it in both review and pentests.
           | We need big changes in all parts of the software buliding and
           | maintaining process. Probably no one will like that, because
           | we are still in "move fast and break things" software
           | development age.
        
         | pojzon wrote:
         | Did you see Google or facebook or Miceosoft customer databases
         | breached ?
         | 
         | The issue is there is too little repercusions for companies
         | making software in shitty ways.
         | 
         | Each data breach should hurt the company approximately to the
         | size of it.
         | 
         | Equifax breach should have collapsed the company. Fines should
         | be in tens of billions of dollars.
         | 
         | Then under such banhammer software would be built correctly,
         | security would becared about, internal audits would be made
         | (real ones) and people would care.
         | 
         | Currently as things stand. There is ZERO reason to care about
         | security.
        
           | GlacierFox wrote:
           | Didn't Sharepoint get hacked the other day? :S
        
             | jaynate wrote:
             | Yes, but those were on-prem deployments of Sharepoint, not
             | Microsoft's infratructure.
        
           | slivanes wrote:
           | I'm all for companies to not ignore their responsibility for
           | data management, but I'm concerned that type of punishment
           | could be used as a weapon against competitors. I can imagine
           | that certain classes of useful companies would just not be
           | able to exist. Tricky balance to make companies actually care
           | without crippling insurance.
        
           | tempnew wrote:
           | Microsoft just compromised the National Nuclear Security
           | Administration last week.
           | 
           | Facebook was breached what last month?
           | 
           | Google is an ad company. They can't sell data that's
           | breached. They basically do email, and with phishing at
           | epidemic levels, they've failed the consumer even at that
           | simple task.
           | 
           | All are too big to fail so there is only congress to blame.
           | While people like Rho Khana focus their congressional
           | resources on the Epstein intrigue citizens are having their
           | savings stolen by Indian scammers and there is clearly no
           | interest and nothing on the horizon to change that.
        
         | bongodongobob wrote:
         | No. You cannot come to my home or business while I'm away and
         | try to break in to protect me unless I ask, full stop. Same
         | goes for my servers and network. It's my responsibility, not
         | anyone else's. We have laws in place already for burgers and
         | hackers. Just because they continue to do it doesn't give
         | anyone else the right to do it for the children or whatever
         | reasoning you come up with.
        
           | krior wrote:
           | But you would like to be notifiedby your neighbours if you
           | have left your window open while away, right? Or are you
           | going to sue them for attempted break-in?
           | 
           | The issue is not that its illegal to put on a white hat,
           | break into the user database and steal 125 million accounts
           | as proof of security issue.
           | 
           | The problem is people getting sued for saying "Hey, I
           | stumbled upon the fact that you can log into any account by
           | appending the account-number to the url of your website.".
           | 
           | There certainly is a line seperating ethical hacking (if you
           | can even call it hacking in some cases) and prodding and
           | probing at random targets in the name of mischief and chaos.
        
           | cmiles74 wrote:
           | It seems like passing legislation that imposes harsher
           | penalties for data breaches is the way to go.
        
           | tjwebbnorfolk wrote:
           | Adding "full stop" doesn't strengthen your case, it just
           | makes it sound like you are boiling the world down to be
           | simple enough for your case to make any sense.
           | 
           | There are a lot of shades of grey that you are ignoring.
        
         | pengaru wrote:
         | > I say this often, and it's quite an unpopular idea, and I'm
         | not sure why.       >       > Security researchers, white-hat
         | hackers, and even grey-hat hackers should have       > strong
         | legal protections so long as they report any security
         | vulnerabilities       > that they find.       >       > The bad
         | guys are allowed to constantly scan and probe for security
         | > vulnerabilities, and there is no system to stop them, but if
         | some good guys       > try to do the same they are charged with
         | serious felony crimes.
         | 
         | So let me get this straight, you want to give unsuccessful bad
         | actors an escape hatch by claiming white-hat intentions when
         | they get caught probing systems?
        
           | doubled112 wrote:
           | What about a white hat hacker license? Not sure what the
           | criteria would be, but could it be done?
           | 
           | Then there would be some sort of evidence the guy was a "good
           | guy". Like when a cop shoots your dog and suffers no
           | consequences.
        
         | atmosx wrote:
         | If companies faced real consequences, like substantial fines
         | from a regulatory body with the authority to assess damage and
         | impose long-term penalties, their stock would take a hit. That
         | alone would compel them to take security seriously.
         | Unfortunately, most still don't. More often than not, they walk
         | away with a slap on the wrist. If, that.
        
         | Ylpertnodi wrote:
         | > I say this often, and it's quite an unpopular idea, and I'm
         | not sure why. > Etc...etc...etc....
         | 
         | Me, neither, if that helps.
        
         | sugarpimpdorsey wrote:
         | Do you think we should have strong legal protections for people
         | who go around your neighborhood trying unlocked car doors and
         | opening front doors (with a backpack full of burglary tools)
         | and when confronted claim they're uh doing it for your
         | security?
        
           | xboxnolifes wrote:
           | The great thing about analogies is that they're just
           | analogies. We can have different laws for different things.
           | Cybersecurity vs physical security.
        
             | sugarpimpdorsey wrote:
             | Hey your front door was unlocked where is my bug bounty?
             | 
             | Some people still live in places where you can leave your
             | doors unlocked and not worry.
             | 
             | Leave it to the tech industry to bring Internet of Shit
             | locks to your doorstep.
        
       | amai wrote:
       | Actually Allianz offers an insurance against cyberattacks like
       | this: https://www.allianz.de/aktuell/storys/cyberschutz-knoten-
       | im-...
        
         | ok123456 wrote:
         | Good to see the contractually required endpoint protection was
         | working.
        
         | 7373737373 wrote:
         | Insurance is part of the problem - companies prefer to insure
         | themselves rather than employ and support the research and
         | development of secure software. As long as this is the more
         | economical thing to do, nothing will change.
        
       | bee_rider wrote:
       | Ignoring the whole pain in the ass this will be for their
       | customers--at what point does this become a tragedy of the
       | commons failure? Actually, I don't know the case-law on this sort
       | of stuff. If your bank authenticates using credentials that are
       | generally publicly known by black-hats for most people--stuff
       | like your social security number and some random bits of trivia
       | (mothers maiden name)--shouldn't they be responsible for any
       | breaches?
        
       | urquhartfe wrote:
       | Fundamentally the issue is that companies are just not investing
       | enough in engineering and IT. When you farm out this work to
       | offshore workers on a shoestring budget, the result is utterly
       | predictable.
        
         | alephnerd wrote:
         | This isn't an offshore situation though.
         | 
         | I've worked with Allianz's cybersecurity personas previously on
         | EBRs/QBRs, and the issue is they (like a lot of European
         | companies) are basically a confederation of subsidiaries with
         | various independent IT assets and teams, so shadow IT abounds.
         | 
         | They have subsidiaries numbering in the dozens, so there is no
         | way to unify IT norms and standards.
         | 
         | There is an added skills issue as well (most DACH companies
         | I've dealt with have only just started working on building
         | hybrid security posture management - easily a decade behind
         | their American peers), but it is a side effect of the
         | organizational issues.
        
           | insomniacity wrote:
           | > They have subsidiaries numbering in the dozens, so there is
           | no way to unify IT norms and standards.
           | 
           | That is _their choice_ though - they _could_ setup a
           | technology services subsidiary, and then provide IT services
           | to the other subsidiaries, transparently to the end users in
           | those subsidiaries.
        
       | Retr0id wrote:
       | Ah! Well. Nevertheless,
        
       | SilverElfin wrote:
       | Is there any consequence? I've seen now a new practice where
       | companies won't even tell you what was compromised. For example a
       | big one last year (?) was at the University of Washington. I had
       | family receive vague letters saying some other place called Fred
       | Hutch cancer center got hacked, and for some reason, the patient
       | data of the university's own hospitals was shared with this other
       | place (even though they aren't patients of Fred Hutch). Both Fred
       | Hutch and UW refuse to tell individuals what data of theirs was
       | compromised, but just say it can include all personal info
       | including medical records and test results and social security
       | numbers. It's infuriating to just see a vague letter with free
       | credit monitoring from companies that should be doing more and
       | fined more.
        
       | ofjcihen wrote:
       | That's partially due to SF devs not knowing enough about the
       | product but also due to Salesforce treating security as an
       | afterthought. For a poorly configured implementation it takes 2
       | web requests as an unauthenticated user to know all of the data
       | you can pull down and then do it. Don't even get me started on
       | the complete lack of monitoring. I basically had to design an
       | entire security monitoring setup outside of Salesforce using
       | their (absolutely awful) logs to get anything close to usable.
       | Edit: here's a guide someone wrote.
       | https://www.varonis.com/blog/misconfigured-salesforce-experi...
       | Seriously, you can automate this and then throw it at the end of
       | recon to find SF sites. I've done it.
        
       | j45 wrote:
       | I wonder if there are independent data audits that can be in
       | place which report back to customers.
        
       | snickerdoodle12 wrote:
       | Jail the executives.
        
       | barbazoo wrote:
       | Depending on which entity, this could affect hundreds of millions
       | of people.
        
       ___________________________________________________________________
       (page generated 2025-07-27 23:00 UTC)