Hacker News Reader

Comment by harryh | Hacker News Reader

Equifax is currently worth about 16.6B. This takes into account the fine, so without the fine they'd presumably be worth 17.25B or so. So this was a fine of 3-4% of their market cap. Total costs associated with the breach were probably moderately higher than that.

That being said, it's important to understand that in the US, penalties are assessed based on the seriousness of the infraction, not on the ability of the perpetrator to pay.

And while it might be the opinion of lots of HN commenters that the equifax breach caused "incalculable" harms, demonstrating this level of harm in court would be tremendously difficult.

View on HN

> ...in the US, penalties are assessed based on the seriousness of the infraction, not on the ability of the perpetrator to pay.

When the penalty is less than $5 per person affected, how am I expected to take that seriously? A penalty based on the actual seriousness of the infraction would put the company out of business, and that's what should have happened.

I agree but what's the actual seriousness of the infraction? Can the court calculate it? How?

Sure they can. Ask Equifax’s lawyers how much it would take for them introduce their SSNs and credit reports into the record. Divide by the number of attorneys and multiply by 145 million people affected.

Let's assume a piece of data is used to empty someone's bank accounts via social engineering. Now it's possible to calculate how much that'll cost the banks. Multiply that by the average worth of an Equifax "customer" and you'll arrive at a nice round number which should put them out of business.

There has been zero evidence that anyone's bank account was emptied due to the equifax breach.

That being said, it's important to understand that in the US, penalties are assessed based on the seriousness of the infraction, not on the ability of the perpetrator to pay.

It's not about ability, it's about whether the fine is a suitable punishment and deterrent.

That being said, it's important to understand that in the US, penalties are assessed based on the seriousness of the infraction, not on whether the fine is a suitable punishment and deterrent.

Reply on news.ycombinator.com