I have a solution:

governments should heavily fine companies that are subject to data breaches.

If it cost them real money (proportional to their market cap, the amount of customers affected, and/or the severity of the breach) to allow a data breach, I’m betting they’d shore up those holes REALLLLLLLLLL QUICK.

This is always the answer. "How do we solve x in y industry?" Make the fucking corpos responsible for their own asses and it will get fixed. If it costs them more money to be breached they will do everything they can to not allow that.
- That, or threaten to nationalize their industry. Corporations *hate * that.
- “Externalities” are just expenses that corporations incur that have to be paid by the public.
  Make externalities losses again.
- It'll also screw over anyone trying to break into the market, ensuring that the big tech companies remain unchallenged indefinitely.
They're too busy proposing legislation to create back doors that completely circumvent security in the first place.
- Yeah, people shouldn't look to their government to protect them from this. Hell, I'd be willing to bet no small amount of taxes go to purchasing the leaked info at places like the CIA, NSA, and FBI.
Article 82, paragraph 1 of the GDPR:
Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.
Paragraph 2:
Any controller involved in processing shall be liable for the damage caused by processing which infringes this Regulation
Article 24, paragraph 1:
**[T]he controller shall **implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation.
Article 5, paragraph 1f:
Personal data shall be: […] processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss,
Article 83, paragraphs 2 and 5:
Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.
Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher:
(a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9;
Article 4, paragraph 7:
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data
(All quotes are excepts, emphasis mine
https://gdpr-info.eu/
- I think we can both guess why these companies never really face penalties that hurt them materially despite this being codified into law in the EU…
- I got lost in the comments... why did you paste that here? To show that it is possible to make the data controller liable for breaches?
They won't because fines are just a fee to allow them to run unethically. That way businesses get more profit than they would otherwise and government gets their cut to allow it. It's broken by design.
- The EU has proven time and again that fines can hurt.
Nah, throw the board members in prison. If the punishment for crime is a fine then it's legal for rich people/corps. Put 'em in solitary and feed them nutraloaf for one day for each person's data they allowed to be leaked.
If they get all the money because they're ultimately responsible, we should make them ultimately responsible.
- HELL YEAH, comrade! 🌹
  I was just working inside of the confines of shitliberalism because it’s seemingly all we have in the United Corporations that run America.
As much as I agree that something needs to be done to these companies, and that they deserve punishment, I think this approach would only result in leaks (even more) underreported, which makes it even worse.
- Are these leaks even being reported by companies? Every article I have seen so far has just been compiling information off the new leaked data set someone picked up off the dark web or something.
This is the stupidest idea I've ever heard. You don't fine a bank for getting robbed. This reeks of frontend engineer idiocy, which is ironically the exact type of idiocy that tends to cause breaches like this.
- Every time some corporatist replies to me, they’re always kbin.
  Your analogy falls apart with even a cursory thought about the differences between banks (which are required to be insured against loss which would make a customer whole again without any negative effects) and corporations that just throw all of their customers’ data onto a portal that lacks basic protection. Once that personal data is compromised, there’s no way to repay the customer and no amount of fines will EVER right that wrong. In a properly-regulated, just society, a bank would ABSOLUTELY be fined back to the Stone Age if they left their customers’ cash in the middle of a town square, for example.
  Be better, you corporate cuck.

Not until a politician or billionaire is harmed by these breaches will we see some action.

They’ll get justice, you’ll get a check in the mail for 3 dollars, after some lawyers win a class action lawsuit.
I don't think so.
Trump himself was victim of credential stuffing. And he's not the only politician or billionaire who has suffered stolen accounts of something.

Who do you recommend?
- Keepass is probably the most secure, but was a pain for multi device / multi OS users last time I used it.
  Currently I use Bitwarden. You can either use their backend or you can self host. Cross platform, multi device support, 2FA support.

I've always thought LinkedIn is nothing more than a massive treasure trove of personal information just waiting to be harvested by thieves wanting the entire life and work history of millions of upwardly mobile career focused people.

Work History ok... But entire life... I guess people that used like it's Facebook maybe? 🤔
- LinkedIn is trying to encourage people to use it as a social networking site.

I honestly wonder if my data wouldn't be safer on some sites, if I skipped two-factor authentication and a recovery email, and simply used my date of birth as a password. At least then, they'd wouldn't be able to leak the phone number or email adress, because I was never forced to give it to them.

It's even more annoying, because you can't easily avoid many of these companies. Eg. for jobs it's really hard to get around using linkedin. I mean, I refuse out of principe and have for years, so my data's a decade out of data, but it's obviously cost me opportunities.

There are almost certainly pictures of me floating around social media, taken without my permission, but tagged by facebook or google just in case I had any fucking privacy. And now thanks to some phones. they also have our finger prints and retinal scans, which will inevitably get leaked sooner rather than later. I pity the poor chumps whose DNA was leaked, that's even worse. Most of that will probably be leaked sooner or later, if it hasn't already, because it turns out a subcontractor used the youtube comment section to communicate between departments.

If I had the technical ability, I would design a two-factor authentication system based on rectal scans.

"Here at OmniCorp we believe all our customers our unique, that's why we believe in securing your data by linking your DNA, phonenumber, social security number, retinal scan and finger print, with a picture of your anus. Bend Over. The Future's Now."

That seems weird, it's called mother of all breaches, but isn't the result of any one breach. It's just data collection from ordinary breaches with perhaps some credential stuffing in the mix.

We just need a free dart monkey or two, it'll be fine.

Tencent tops the chart, with 1.5 billion records leaked, followed by Weibo at 504 million and MySpace at 360 million.

MySpace in the news as Top Western Leaker

They said this about the equivalent breach, and yet here we are.

Kind of worrying when their source is a “data breach information website” that does advertorials for “the most safe password manager” NordPass. 🤮 The internet of today has become a pile of absolute shit.