Earlier quoted context omitted.
> I am very doubtful that Intuit or H&R Block, for example, invest in security sufficient to protect themselves against that level of attack. I can't speak to H&R Block, but I used to work for Intuit and I can attest that they took security very seriously. We were often subject to extreme security precautions despite the fact that the application I worked on didn't have any PII and the entire purpose of it was to mak…
Why would anyone build a data center to host tax software? This is almost the cononcial / text book example of when you would opt to host on a cloud provider.
But when you look at the money involved, you can see why Intuit is moving so slowly and is willing to continue to spend on its own data center. $40m/yr may sound like a lot of money, but when your product pulls in $3b/yr, it's a rounding error. And the data centers aren't dedicated to TurboTax...Quickbooks and a few other products run there too. And I have to say that, for certain services, I think you get a lot of piece of mind from not sharing and having your own data center. Take, for example, Intuit's service for scraping data from financial institutions (FICDS). It powers Mint, Quickbooks and TurboTax and is required to store login credentials for people's banks, retirement accounts, brokerage accounts and such. Needless to say, the security of such a service is paramount and there's no way that I'd ever entrust my banking credentials to any service hosted in the cloud. You just can't get the same level of security you can get when you've got physical control over your hosting.