The information in the exposed database included the email addresses of parents who used TeenSafe, the Apple ID email addresses of their children, and children’s device name and unique identifier. Plaintext passwords for the children’s Apple ID were also among the data set, despite claims on the company’s website that it uses encryption to protect customer data.
It’s incredible to me that companies allow this kind of stuff to happen. It’s inexcusable.
Data breaches will continue until companies are made liable for them – if the company had to pay $10 for every id that gets exposed from their database, you can be sure that they’re going to clean up their act pretty quckly.
Yea, but then the risk of doing business would be too costly and only the largest of companies would be able to afford that kind of liability.
I’m not saying companies shouldn’t be held accountable for downright lying about their security methods. But I don’t know what the right answer is. You want companies to be accountable, while at the same time keeping the market viable for new start ups.
This is one of the main points of the European GDPR: to have enough teeth to really hurt big companies if they do things wrong. The harshest fine for the biggest breaches of the regulations is €20m or 4% of company turnover—whichever is higher. Because they know that unless they can scare big companies, nothing will change.