Also Mastercard:

You don’t usually buy much but today you bought a very expensive TV and then got a car wash in a part of town you haven’t been to for two years.

We aren’t calling you about the TV. We’re calling about the $8 car wash.

(Actual incident)

Companies have little direct motivation to have good security practices, they're only motivated to manage their reputation. Any attention they pay to security is only a side-effect of caring about reputation management.

Mastercard should be heavily fined for this. And I mean really heavily, like some percentage, or fraction of a percentage of global revenue. That's how you get them to take security seriously.

> The only way to (sometimes) get big companies to fix their mistakes (besides the legal system) is to shame them into it.

in the golden years of twitter the quickest way to get proper support from companies was to talk shit about their services on twitter.

i was always amazed by how quick i could get in touch with an actual human being using that strategy.

this remind me of some other borderline unethical techniques i read online...

basically when dealing some kind of problems with non-IT infrastructure, if you cannot get "support" to acknowledge issues then you change your strategy and write to the lawyers from the company or public entity managing that piece of infrastructure and inform them of the legal liability deriving from the issue that you noticed.

once that is done, if ANYTHING happens, they cannot deny knowledge of the issue.

they will involve whoever is needed, internally, to get the issue fixed.

so yeah... basically often times to get technical issues fixed you're better off resorting to a human (rather than technical) approach.

Yeah, isn't it pretty standard to first report privately, then report publicly if they don't take any action (and you believe it to still be an issue)? That seems consistent with mosr organization's responsible disclosure practices.

Can security researchers send an invoice for a reasonable amount conmesurate with the value of the service provided and then sue for quantum meruit if it is not paid?