I’ll say the elephant in the room - due to the sheer amount of Salesforce customers who have been hit, and that Salesforce is a fully SaaS service - Salesforce should have detected and been more proactive about all of their customer’s data being stolen. https://databreaches.net/2025/09/11/exclusive-high-end-fashion-retailers-gucci-balenciaga-brion-and-alexander-mcqueen-hit-by-salesforce-attacks/
Exclusive: High-end fashion retailers Gucci, Balenciaga, Brion, and Alexander McQueen hit by Salesforce attacks – DataBreaches.Net

Those readers who aren't A-listers (including yours truly) may never have heard of Kering , but you may have heard of their high-end fashion brands: Gucci. Yves

DataBreaches.Net

@GossiTheDog A tort of privacy must exist. And, I'd suggest that proactive monitoring and prompt notification - given that it reduces the consequences to the effected - should be legislated as to be taken into account with damages (which would encourage proper behaviour).

And then should be followed up with a criminal provision that can piece the corporate veil, but if my last suggestion is a stretch, that one is on par with dealing 5 aces in a row from a standard 52 card deck.

@lachlan @GossiTheDog I've been suggesting the tort solution for a while. This all happens because the economics of data privacy are essentially the same as that of pollution.

www.securityeconomist.com/digital-pollution-the-hidden-cost-of-insecurity/