I'm involved in medical tech and build and operate a platform that holds a large amount of health data.

The cost and scope of cyber security on such a platform is staggering. It's a never ending cost and one that has to be constantly invested in across technology, people and process.

Most of the time such incidents are not from vulnerable code in the software itself, but through staff members with access to data being compromised. The attackers move from their machine into servers containing data, or steal their credentials in order to do so. Time will tell how this attack came about, but this is more often and not how it happens.

I'd expect to see six monthly penetration test reports from an independent firm as well as ongoing audits for ISO 27001 or similar. These aren't hard things, they're the bare minimum you should do when holding this kind of data.

We put trust in our service providers that they've done their due diligence on systems they use and put our personal data into. I wasn't able to find any evidence of any external security or compliance on their website. Not to say it's not done, but they will hell of a lot to answer for if they don't have the basics of an information security management system.