Hacker News Reader

Comment by codedokode | Hacker News Reader

Here is something that doesn't feel right. The article says:

> The breach has so far cost US bank Capital One, one of the 30 institutions affected, more than $270m in compensation and regulatory fines.

The bank claims that it is hacker's fault.

But isn't it wrong? Bank was fined and sued not for having been a victim of a hack but for not storing data securily, not configuring the cloud accounts properly. For not following required procedures. Therefore, as I understand, the bank should have been fined even if there were no breach.

Or are they blaming the hacker for exposing the violations? Do they assume that it is ok to violate regulations as long as nobody knowns about it? That's ridiculous.

View on HN

These are two independent, but related, things.

The bank indeed was guilty of not properly securing customer data. The breach exposes this, and the bank was fined and sued accordingly.

Thompson is also guilty of wire fraud for the breach. You can't steal stuff just because it's easy.

It doesn't have to be one or the other. The bank was negligent, and Thompson is a fraudster.

> The bank claims that it is hacker's fault.

I don't see that claim in the article.

I mean to be clear up front she very much did do a crime, she is not a white hat hacker, however.

> Here is something that doesn't feel right.

I totally agree, it's a strong indicator of an oligarchy. Same as Chevron basically putting a lawyer in jail for suing them on behalf of the people's whose lands they poisoned. Threats to wealth are punished by our "justice" system more severely than similar crimes.

the hacking happening means the accounts weren't secure, hence the fines and settlement.

the insecure configuration is not tied to the hack, and was only exposed because of it.

the insecure configuration was there, independent of the hacking, yes, but it was unknown.

so, the hacker only made regulators aware of the problem, and that's what Capital One blames the hacker for. regulators would not have known if the hacker didn't take advantage of their insecure configuration, and now, regulators are fining them.

to you and me, the fault is on capital one for having the insecure configuration, and on the hacker for exploiting it.

to capital one, they did nothing wrong, and were only punished because of the actions of someone else.

Seems like Capital One was punished by the feds. Now they are punishing the hacker.

>Now they are punishing the hacker.

To be clear, "they" is the feds. Wire fraud is a federal crime. The federal government brought this case against Thompson.

Reply on news.ycombinator.com