Well, what would happen would be, any sane bushiness would take out insurance, and the insurance companies would mandate / audit security best practices. If a

Well, what would happen would be, any sane bushiness would take out insurance, and the insurance companies would mandate / audit security best practices. If a shop wants to insure it's stock, the insurance company tell them what they need. An alarm? Big metal shutters? A night guard. Depends what you are guarding. In practice, a password is pretty valuable. Not to the company, but the loss to the user can be pretty significant. In the UK, the Data Protection Act does allow fines against companies that fail to encrypt specific information (inc passwords). They handed out 2.5MM in fines last year, but I think they mostly go after people selling data, rather than just messing up and losing it. Recent UK fines: http://www.ico.org.uk/enforcement/fines http://www.ico.org.uk/enforcement/fines OH WOW they fined sony after the geohotz hack http://www.ico.org.uk/enforcement/~/media/documents/library/Data_Protection/Notices/sony_monetary_penalty_notice.ashx http://www.ico.org.uk/enforcement/~/media/documents/library/... (only £200'000, but still)