[PantaloonFlames]

The forbes article is good. The original linked article is so poorly written, I thought it was a sham.

The Forbes article says that the US is one of the few countries that does not have laws requiring the protection of such information. But let me ask: what would a new law change about this particular incident?

Unless the law specifically requires that someone go to jail, then the law will make no difference. The owner of the data didn't mean to expose it all. It just happened.

We already know that when companies flout the laws, no person goes to jail. The company pays a fine and everyone continues doing what they were doing. The punishment is irrelevant. With this kind of repercussions, Laws are ineffective.

[QAPereo]

Set a value on the info, statutory value, and suddenly a breach can bankrupt you, you seek insurance, and the insurerers want due diligence of your infosec.