Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T says criminals stole phone records of 'nearly all' customers in data breach

techcrunch.com

Post reply on HN
Print view View original

241–250 of 874 posts

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#241

Post by slg »

cm2187 wrote: post #170
graybeardhacker wrote: post #95

Earlier quoted context omitted.

I agree. This is precisely why breaches keep happening and will keep happening. It cost money to implement security. There's no cost benefit to spending that time and money since there are no consequences. Businesses do not spend money unless it will make them money or save them money. There needs to be a hefty federal fine on a per-affected-user basis for data breaches. Also a federal fine for each day a breach is u…

Most breaches are because of developper incompetence. Throwing money at it won't really help. You need better basic security skills.

No two people are incompetent in exactly the same way. Hiring two developers to review each other's code leads to better code because they will often find problems that the other one didn't see. In a well managed organization (admittedly not a trivial caveat these days), more people working on security leads to better security.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#242

Post by hodgesrm »

weezin wrote: post #141
jader201 wrote: post #84

Earlier quoted context omitted.

I never got the impression that the market ever cares about data breaches. It seems most companies are rarely held financially responsible for data breaches anyway. I would bet any effects you’re seeing in stocks is unrelated to this news.

Really should be up to the government to fine these companies and pay out to those effected to disincentivize lax security standards.

Well, I guess we devs should also be looking at ourselves, then. A lot of the lax security comes from us collectively choosing to build applications using cloud services that talk to each other over the public internet. That pretty much describes the so-called "modern data stack."

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#243

Post by John23832 »

Aaronstotle wrote: post #40
John23832 wrote: post #9

How has Snowflake felt ANY recourse for being the source of all of these hacks?

its not Snowflake's fault their customers used weak passwords and no MFA. Not enforcing MFA does merit some blame on Snowflake, however, I still think its on the customer to secure your own environment.

I feel like this would be true if ONE customer was hacked. At this point it's more than a handful. AND snowflake knew about it.

If all the lockboxes in a bank get broken into, is it respectable to say "ah all of the customers should have used better locks"? The bank is the party who is supposed to be giving the insight into secure storage. They're not just renting space.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#244

Post by jkaptur »

teraflop wrote: post #192
rybosworld wrote: post #136

Earlier quoted context omitted.

There is some evidence that it does hurt stock prices: https://www.comparitech.com/blog/information-security/data-b... "Stocks of breached companies on average underperformed the NASDAQ by -3.2% in the six months after a breach disclosure" That said, it's not clear what the long term impact is on stock price (if there is any).

Unfortunately, that analysis seems to have made absolutely no attempt to check whether the results are statistically significant. Pick 118 random companies at 118 random points in time. It's vanishingly unlikely that the average returns of that group will exactly track the NASDAQ returns over the following 60 days. It might underperform, or it might overperform. An underperformance of 3.2% could easily just be the re…

My hypothesis would be that companies with poor operational practices are more likely to underperform the index and have data breaches - in other words, that the study confuses cause and effect.

This wouldn't be that hard to test. I suspect that the breached companies underperformed in the six months before the breach as well as the six months after.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#245

Post by [deleted] »

jader201 wrote: post #84
smcin wrote: post #70

AT&T stock has already bounced back from much of the initial -2.6% drop this morning, so the market thinks AT&T is immune. Meanwhile Snowflake is -3.9% down (they have many other customers than AT&T). https://www.marketwatch.com/investing/stock/T https://www.marketwatch.com/investing/stock/SNOW

I never got the impression that the market ever cares about data breaches. It seems most companies are rarely held financially responsible for data breaches anyway. I would bet any effects you’re seeing in stocks is unrelated to this news.

[deleted]

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#246

Post by jen20 »

criddell wrote: post #237
jen20 wrote: post #229

Earlier quoted context omitted.

The root cause is not whether engineers are licensed (I'm fine with that idea, but it's not going to resolve this specific problem). Instead, it is a culture of not caring about security because the fines are a cost of doing business is, and which comes from management, and treating personal information as an asset instead of a liability. A Sarbanes-Oxley style law that makes the CEO personally criminally responsible…

When a doctor is negligent, their employer is often also sued if it can be shown that it knew shenanigans were underway and did nothing. We shouldn't choose between holding engineers or executives responsible. Each should be held responsible for their part.

Indeed - but we should start at the place likely to actually make a difference: the executives.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#247

Post by seadan83 »

soulofmischief wrote: post #146
smcin wrote: post #93

Earlier quoted context omitted.

They are very much related to the news, that's precisely why I linked to the stock charts: AT&T was flat overnight but opened (9am ET) with a -2.6% spike down, but has been recovering since. Their press release appears to have been Friday 7am ET shortly before market open [ https://about.att.com/story/2024/addressing-illegal-download... ]. Also as corroboration here's MarketWatch: "AT&T’s stock slides 3% after compan…

I'm not saying there's no way the stock pullback wasn't caused by the hack, but it's also important to note that MarketWatch article only establishes correlation, not causation.

Most linked financial news is auto-generated and auto-correlated. Lots of "why did.." when nobody knows, and frankly there often is no why. Perhaps that was the day a retirement fund shifted money, who knows.

While this price movement is very well correlated, perhaps causal even, but marketwatch (and all similar bottom feeders that are just trying to make ad revenue), it's a case of a broken clock being right. Those financial news sites which link recent news to stocks, eg Yahoo, benzings, - those recent news headlines are just the same as ad tech now. It is noise.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#248

Post by 93po »

graybeardhacker wrote: post #104

Freeze your credit people! It's super easy. It's not a perfect fix but it's so trivial to do and it will help. https://www.usa.gov/credit-freeze You can unfreeze through an app whenever you want/need to.

I was unable to get any of the three to verify my identity last I did this, and one of the three has never once in my 15 years of trying to get my free credit report let me actually get it.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#249

Post by sitkack »

dylan604 wrote: post #142
sitkack wrote: post #60

Earlier quoted context omitted.

You can still recover that without timestamps. It also looks like if anyone interacted with an ATT customer or used an MVNO your data is in there too.

It even said land lines had their numbers in the data if an ATT customer contacted one. Edit: I must have read that from a different article than the TFA though.

Yeah, all att customers, 2nd party participants and any other user of their network. Not just direct customers.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#250

Post by pas »

CityOfThrowaway wrote: post #133
malcolmgreaves wrote: post #118

Earlier quoted context omitted.

That requires people to be rich enough to sue. It takes a lot of money and time to sue. Almost no one has enough resources to do this. The courts are not an effective way to implement this policy. Unless you only want rich people to be able to get justice.

110M people impacted = class action The lawyers work on contingency

showing damages is hard
Post reply on HN