I'm starting to work through some ideas with a book I want to write. The protagonist is computer science genius that finds flaws and breaks through the security of several major companies. I'm not sure if I can legally mention real companies such as Netflix, Facebook, Google, or others. I know I can't defame or say bad things about a company or try to promote their products, but I'm not sure if having a character steal sensitive data from these companies would be defamation or anything like that.
I am not a lawyer, so do some legal research. The following is my opinion and not legal advice.
They may well regard this is defamation, if your character can break into them it means they have lax security and their customer's information is not safe with them. It means they are not safeguarding their customer's information (credit cards, birthdates, passwords, answers to security question, etc) from hackers.
That is why author's nearly always use fictitious companies that they make a point of saying are NOT Netflix, Google, Facebook or any other known company. You CAN claim anything you want about our government agencies, that falls under free speech and they cannot punish you for defamation. The same is supposedly true about elected officials (but be careful about naming people, because I think you can defame an unelected government employee).
In general, do not use the name of any actual corporation or actual person, and if your character is very similar to one, make a point of NOT using anything that uniquely identifies that corporation or person, and make a point of distinguishing your corp/person from the real one by saying they have done something like "they became the next Facebook", or your guy is a competitor of Google, or friends with the founders that went his own way, or whatever.