So you are saying, if a company negligently loses some important data about me; lets say enough to create a fake identity or access my medical records, my only

So you are saying, if a company negligently loses some important data about me; lets say enough to create a fake identity or access my medical records, my only recourse should be to stop using them? How does that work in a case like Equifax?