Privacy

iow, "We got so comfortable in our operation that we never even considered the digital security of our business or customers".

ZEGO did not disclose what kind of attack it suffered, whether ransomware was involved, who was behind it, or whether customer or employee data was compromised.

I wonder if they even understand the scope of the compromise. They clearly cut corners on business continuity insurance. It wouldn't be surprising at all if the breach fried all their equipment (like stuxnet). Their systems were probably on or adjacent to internet routes.

6 weeks offline is rough, but not "shutter an otherwise totally profitable business" bad, especially not one that's allegedly had 37 years to save up for an outage and/or discover the wide world of business insurance.

Something tells me the poor IT security was just the tip of the iceberg on a looong list of missteps.

ZEGO did not disclose what kind of attack it suffered, whether ransomware was involved, who was behind it, or whether customer or employee data was compromised

GDPR states that if personally identifying information was compromised, the users must be notified. They can't just decide not to publish what happened. It's against the law.

This screams "upper management didn't make security a priority".

I don't buy it.