> Why do companies offer only 2yrs of identity protection coverage for breaches? Two years seems like the minimum they feel they can get away with. They just n

> Why do companies offer only 2yrs of identity protection coverage for breaches? Two years seems like the minimum they feel they can get away with. They just need to make it seem like they've done "something" to compensate their victims out of fear that if they didn't some regulation will come along that requires that they actually make up for the harm their negligence has caused in an actually meaningful (and more costly) way.