zlacker

> Actually this Chris guy has a point. I don't call it breach either. It's PII data exposure but it is a serious exposure.

At least California defines it as

> unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person.

https://oag.ca.gov/privacy/databreach/reporting

>>hrimfa+(OP)
So I guess if you authorize the entire world to read the data, it’s not a breach.

>>bo1024+pR
If nobody reads the data it is not a breach.

>>SigmaE+Dr1
So the junior engineer who couldn't secure an endpoint implemented thorough request logging and auditing? Impressive.