This is negligence; plain and simple. Users have a right to expect web service providers to keep their private information secure with basic industry standards. Someone should sue them and set a precedent.

http://en.wikipedia.org/wiki/Product_liability