When a private company has a massive failure that impacts someone other than its customers, then the impacted parties have no recourse whatsoever.
You're not an Equifax customer. Banks and big businesses are, and they don't really have a strong incentive to punish this sort of behavior.
IANAL. This is absolutely not true. You don't have to have a direct relationship with the other party in a negligence case. An easy example would be that you can sue the manufacturer of your transmission even though your Civic was sold to you by Honda. Equifax would have to somehow argue that they owe no duty of care to the people with private information in their database which just isn't going to happen.
This has always struck me as an odd anti-regulatory argument, though. "Governments shouldn't use their power to distort the market. Therefore regulations are inherently bad. Instead we should distort the market using a different branch of the government, but in a much more capricious and unpredictable manner."