This is a great point. Without heavy fines and penalties, it seems many companies are happy to be lax on security just quietly become another "victim" company.

This is a great point. Without heavy fines and penalties, it seems many companies are happy to be lax on security just quietly become another "victim" company. They just need their breach to smaller than Yahoo's (which is easy for most companies).