Who should be made responsible? --- I remember a few years ago when, largely, I was told that cybersecurity was about people doing insecure practices. Implied in it was a discourse that being hacked was necessarily a consequence of a bad decision from the victim. Now, with more experience, I have to disagree with that perspective I was given. The case of Orion and many others show that even very security-focused organisations and people can get hacked out of no fault of their own. This makes me wonder about the legal consequences. What do we make out of an organisation who did all the due diligence but got its customers' personal data leaked out of a third party's vulnerability?

Source author: Gustavo Paiva gdp.direito@gmail.com