Until there are criminal penalties, with jail time, for companies that fail to secure, and state mandated levels of financial compensation to customers (say $20,000 each for loss of PII), nothing is going to change.