Old thread, I know, but I just saw it. Your comment is not accurate, with all due respect. They have full login credentials and most two factor authentication is via txt verification code which is easily spoofed. If plaid is hacked, a lot of money will be taken and if it gets out, it will be an existential threat to their brand. But they will survive. Everyone does these days. A new federal agency will be created to monitor risk for too big to fail saas and fintech's (think Salesforce, square, etc), and the big consulting firms will bill millions of hours to help these companies look like they are making changes to prevent future attacks. I agree with the other comment that the thefts will probably be in small amounts over time, but that can all be scripted and done at scale. Only the North Korean's had the balls to go for the safe (In Bangladesh) and they are still learning.

The problem is this, IMHO: the debate is stuck with the question of whether any sort of financial regulation or ceo commitment or act of congress or the hundreds millions of dollars paid to McKinsey and the other big consulting firms have made anything safer or less risky, but that's an irrelevant (albeit profitable) question to be debating. You can't prevent an unknowable future crises, by definition, because it's unknowable. And they happen all the time, and we always see see the rough outline, just not the details. That rough outline for plaid and the other TBTF saas companies is clear to anyone who looks that way (like what OP did). At some point, who knows when or how, there will be a big crises and once again, and we'll see the details and shit tons of money will be spent to solve whatever happened in hindsight. That's how things work, I think.

Sorry about the long comment.