Why? What do they lose? Equifax for example is doing just fine. They don’t feel the pain, we do.
There are no fines. People don't stop purchasing stuff from them.
The risks of not following security practices are so low that it makes logical business sense to not care much about them.
Now, say if we add fines on these security breaches. Proper fines, say % of global revenue type fines. Then yeah, they'll start caring.
Until then, wait for more of these security breaches.
Well, I am, yeah.