What I mean is that for an institution of higher education and intellectual research, the bar for ethical action should be higher. An apology (with guarantees and plans for improvement with oversight) is better than put a low price and call it cost of doing business. The damages or negative consequences are going to happen no matter what as information is already out there.
My point is not about the money that as person I would get or not. My personal private information is mine and should be protected and the law require that. If anyone consider that it is worthless or not is irrelevant. And because the affect does happen on a scale. This breach for example affect probably close to 200k or more (maybe much more).
My point is we shouldn't normalize that, just if "corruption" is widespread in a place then we should fight it not just say this is how things works. Same thing should happen here. And we should hold people responsible for the decisions liable. This way the simple decision of ignoring cybersecurity or outsource to the lowest bidder suddenly becomes unattractive.
Also I don't understand the logic is that because I got "abused metaphorically" before then it is not a big deal if this happens to me again. Why do we accept this in such case and not in others? And actually in my particular case, the university breach was probably the first breach of my personal information (others happen later). why would that change anything?