> When a private company has a massive failure that impacts someone other than its customers, then the impacted parties have no recourse whatsoever.

IANAL. This is absolutely not true. You don't have to have a direct relationship with the other party in a negligence case. An easy example would be that you can sue the manufacturer of your transmission even though your Civic was sold to you by Honda. Equifax would have to somehow argue that they owe no duty of care to the people with private information in their database which just isn't going to happen.