I feel like a broken record lately: if these companies cannot keep this data secure (which for all intents and purposes, true security is difficult if not impossible) then they should not be allowed to process it. To put it another way, we should be changing the system such that this sensitive information does not need to be on the cloud, i.e. "someone else's computer".

And to expedite this understanding, we put execs in jail when their companies fail this egregiously and with such implications for so many. No fines. Just jail. Watch things change overnight when consequences are back in the formula.