The stolen hard drive story appears to be a bit different than you portray: https://healthitsecurity.com/news/washington-state-university-settles-4.7m-data-brea

The stolen hard drive story appears to be a bit different than you portray: https://healthitsecurity.com/news/washington-state-university-settles-4.7m-data-breach-lawsuit https://healthitsecurity.com/news/washington-state-universit... If the liability had been $50MM or $500MM, you can bet their storage practices would reflect it (not to mention actually telling people you're collecting their data). "Eh, whaddya gonna do?" is absolutely a normalization and a devaluing well out of proportion to the damage that is done.