> In a direct message sent via X in July, Nullbulge said it accessed Disney’s data through a company manager of software development, whose computer it compromised. The material taken appeared to be limited to public and private channels within Disney’s Slack that one employee had access to.
Isn't that on Disney for preventing unauthorized access to the machine? I guess a case could be made like S3 that more default protections should be in place, but that's a tradeoff on how annoying do you want it to be for your users vs how secure does your data need to be in this system?
> The incident wasn’t expected to have a material impact on its operations or financial performance, the filing said.
> In a direct message sent via X in July, Nullbulge said it accessed Disney’s data through a company manager of software development, whose computer it compromised. The material taken appeared to be limited to public and private channels within Disney’s Slack that one employee had access to.
Isn't that on Disney for preventing unauthorized access to the machine? I guess a case could be made like S3 that more default protections should be in place, but that's a tradeoff on how annoying do you want it to be for your users vs how secure does your data need to be in this system?
> The incident wasn’t expected to have a material impact on its operations or financial performance, the filing said.
So not a big problem? Sounds like scapegoating.
Discussion about the breach a few months ago:
Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data
https://news.ycombinator.com/item?id=40955693