They should be required to pitch into a state monitoring insurance fund as long as the social security number of person who's information leaked, hasnt rotated

They should be required to pitch into a state monitoring insurance fund as long as the social security number of person who's information leaked, hasnt rotated yet. Seriously, what good does announcing 2 years of monitoring do, all it does is set a countdown to when somebody with the information knows to start using it.