> I feel like the people who calculate that it's more cost effective to deal with the hit from a security breach vs spending money on good security have won.

They do win, unfortunately because they're right. Why spend much on designing security when the inevitable breach costs nothing other than bad press for a few days and then all is forgotten.

The only possible solution is to have significant fines for every data item breached.

Ideally I'd ratchet up the fines for each occurrence. First breach should hurt the company financially a bit but not be too disruptive, offering a learning opportunity.

Subsequent breaches the fines go up, by the fifth breach or so the fines would wipe away the company entirely, since they clearly didn't learn.

Anything short of something like this, companies will never care and leak all your data to the wind every year.