The incentive problem goes even deeper than that, because customers themselves also don't have a good way to measure the costs of breaches. If someone company

The incentive problem goes even deeper than that, because customers themselves also don't have a good way to measure the costs of breaches. If someone company gets hacked, a consumer's gets leaked, and 3 years later that info is used to steal that person's ID, how is that consumer supposed to determine the root cause? The real problem is that the effects of bad security are very far downstream from the initial problems in space, time, and individuals affected, so proper feedback to those responsible happens very slowly or not at all.