One exposed platform, forty-plus listings, no encryption. The stolen category — engineering IP — triggers no notification law anywhere.