This kind of inept security should be punished at a level that makes it cheaper to do it right than to pay a small percentage of their profits to continue with their assault on citizens' private info.
Until holding and losing PII (Personally Identifiable Information) is treated and punished like holding and losing radioactive waste, this will not stop.
The penalties for losing PII should be sufficiently high that even the most junior programmer should recognize the probably and immediately blanch whenever asked to write code about it.