> ... there will have to be a bigger, more painful incident before anything gets done. I'm not sure how that happens. Equifax basically exposed everyone in th

> ... there will have to be a bigger, more painful incident before anything gets done. I'm not sure how that happens. Equifax basically exposed everyone in the US with any credit to identity theft and scams. If those thefts trickle out bit by bit over a few years, there will be no single, shocking crime wave, and nothing will happen. It doesn't take genius-level criminals to avoid creating a big enough incident. On the other hand, I would be curious what would happen if some public-minded hacker stole ~150m people's data from one of the other two CRAs, then publicly released 538 specific records...