Maybe if they lose something specific like message content, order history, etc. But businesses are not morally culpable for banks and governments' inexcusable c

Maybe if they lose something specific like message content, order history, etc. But businesses are not morally culpable for banks and governments' inexcusable choice of shared secret numbers to prove ownership of identities, bank balances, credit lines, etc. when public key crypto has been available for 20+ years. It should be the entities who deliberately perpetuate broken security architectute like CC numbers, SSNs, paper ID documents, who bear the cost of their inevitable copying. Businesses have to architect for the world we have, yes, but still.