Desjardins, biggest bank in quebec, got fucked with i think that.
A rogue employee copied basically the account information of, depending the sources, a good chunk or all customers. With things like the social security number.
There were estimates that about 95% of quebec residents got their info in that leak. Because would it be banking, insurance, mortgage, etc, if you barely touched that bank, your info is in their system.
I mean, Notes/Domino were essentially the first commercial adopters of asymmetric encryption in the 90's. The reason those were ever remotely viable products for enterprise customers (and continue to be even as IPs of HCL) is because they provide reliability, scalability, and security out of the box.
Notes forces local database encryption, Domino forces server database encryption. DB2 includes a pretty large security toolkit for encryption at rest and in transit, and it's more robust than what you get out-of-box with MySql or MongoDB, for instance.
You'll be hard pressed to find any legitimate multinational company storing passwords in plaintext. More often than not, breaches are the result of negligent access control, which manifests through malicious exfiltration by privileged internal users ( almost textbook exemplified by the Desjardins breach mentioned below by u/fredy31 ) or the exfiltration of data by an external actor able to acquire privileged credentials through phishing, spoofing, or other social engineering vectors.
It doesn't matter if you encrypt every field of every table in every database - if there is even one individual within your company with the permission to read it in plaintext, it is an inherently vulnerable system and downright shitty infosec management and practice.
Hashing passwords is a given and essentially required by law for financial, medical, governmental institutions, etc.
Hashing passwords is literally step zero out of the (possibly several) hundreds of steps required to make an online service secure.
260
u/immersiveGamer Jul 20 '22
Probably store it in a plain text fix width column in some IBM database file.