With a market cap of $18 billion for Equifax, it seems like they had the resources to get this right. I see the difference as who shoulders the cost. If you pay

With a market cap of $18 billion for Equifax, it seems like they had the resources to get this right. I see the difference as who shoulders the cost. If you pay $400 million for a defective plane, you have one company whose toes you will hold to the fire. If you lose data worth $400 million for 138 million people, you have about $2.89 average per compromised person, so no single person will really go that far out of their way to crucify you, and if one does, they have perhaps tens of thousands of dollars to use in the legal system holding you accountable, not the millions one large wronged party may spend on it. In aggregate economic terms, in actual loss and negligence, I don't see that much difference. If you want to steal a lot, steal a small amount from a large number of people. It looks to me more like a matter of the feasibility of getting away with it.