It is. The majority of the enforcement work is around industry safeguards and customer re-imbursal from insurance pools. And very little of the work is around p

It is. The majority of the enforcement work is around industry safeguards and customer re-imbursal from insurance pools. And very little of the work is around prosecutions because the liability is shifted and moved around very similar to a corporation, but even more distributed. The hacker doesn't hack, but sells the information to be weaponized. The person that weaponizes only does that to get a giant leak of data, that they sell in pieces. The person that buys a few cards, gets 1 that works, and now we are talking about a few thousand dollars. Almost too small to care for a big investigation. And so on and so forth. There is rarely anyone to levy the whole force of the RICO act + CFAA + Wire Fraud + Conspiracy + Using a fake ID + etc etc