I worked incident response for years, logging thousands of hours of actual on site work with impacted clients.

No on cares.

Clients see this as the cost of doing business and have no incentive to do better. Even after Equifax and OPM.

Until we have a GDPR style law in the U.S. it will continue to be status quo.