I see a lot of comments about more punishment and regulation - but that could actually backfire and cause the problem to become worse. More penalties would rai

I see a lot of comments about more punishment and regulation - but that could actually backfire and cause the problem to become worse. More penalties would raise the stakes for the data, making it far more valuable to hackers. What's the value of data which, if exposed, can cause people to go to jail or lose lots of personal wealth? A lot, especially for ransom or blackmail. Take HIPAA data as a prime example. What is the inherent value of health data to hackers - not much, for the most part. Maybe a little value if you get some public-figure data, but who cares what prescriptions I (a nobody) am on? The primary value to hackers of health data is exactly that it is very regulated and penalties for exposure are very high. This makes it great for blackmail and ransom. So now we have tons and tons of various nonsense "security" and "privacy" hoops we have to jump through and many $B's of cost related to protecting it. How many BS privacy policies have you gotten in paper form? How many privacy liability-waivers and other such docs have you been forced to sign before every medical treatment? The better approach is to reduce the value and quantity of this data in the first place, so that hackers won't spend as much effort trying to steal it, and when they are successful it doesn't matter as much. What if SSN's weren't used as ID numbers everywhere? What if it were much harder to abuse credit card numbers? What if we didn't keep allowing/REQUIRING companies to store so much personal information about us in the first place?