> Mr. Cooper said in its regulatory filing that the cyberattack will cost the company at least $25 million, up from an estimated $5 to 10 million, largely due to paying for identity protection to its current and former customers for two years.

For a company that makes ~$2.9 billion revenue, $25 million is a drop in the bucket. Why aren't there more repercussions for companies that can't protect their customers' data?

There have been so many breaches that result in "free identity protection services". Maybe these "identity protection service" companies are paying the hackers?