Ask HN: Why is the resolution to data breaches:“We will offer credit monitoring”
Why do companies continually seem to do this? And not remediate the vulnerabilities inherent in their systems?
The issue I have seen in a few incidents is that a company will fix the 1-2 issues that they feel caused the data breach but not take a serious look at overall security. To me that just means they aren't serious and realize that the cost of providing credit monitoring is cheaper than fixing issues and consumers aren't demanding more so it passes as good enough.
What is going to have to change is that consumers in quantities beyond 1-2's are going to need to start suing for damages. Personally, I think the damages could be fairly high. Think of the cost of credit, lost or reduced employment opportunities, car insurance etc. All of which cost more or are damaged when your credit is dinged regardless of the source. Multiply that by the years it can take to repair your credit even with all the proper legal documents etc and then by the number of consumers affected in some of these cases. That could be a big number which starts to get corporations to change their tune about security.
Of course, to me Credit Bureaus is an industry ripe with potential to disrupt. The problem is the barrier to entry is steep and the incumbents are not going to let new players in without a major fight, so my guess is the cost would likely be high.
A big component of real world security practice is that fixing things has real, serious costs and so businesses will compare those costs to the costs of simply not fixing them and rolling some dice.
Even the ever-critical Bruce Schneier understands and recognizes this reality.