One time there was a leak from a university database and as a result there were a few news articles over the years about people that had their identity stolen likely due to that leak. It's not just credit card charges. They have had loans taken in their names, stuff bought on store credit or something (nowadays that's not so easy), stuff stolen from library in their name...

They had to deal with the fallout for years, always fearing that there's a new letter waiting at home regarding some unpaid expense or from debt enforcement agency that they have to contact and try to make it go away. It shouldn't be too hard if you have an open case with the police but it's not always that easy.

Also, if the leaked data is sensitive (e.g. private conversations, records about mental health etc.), you can face extortion or the data may get published.

One other thing that I know of personally is that victims of harassment very much don't like to have their contact info leaked to the harasser.

If the most severe consequences of this pattern are sufficiently uncommon—uncommon enough that even by your own admission the system as a whole fails to notice them, much less feel any pain over it—then maybe it's a waste of the organism's resources to attempt a systemic resolution. Maybe the "losing battle" as you call it is not with individual organizations or even with broader data security culture per se. It might not even be with the legal system to finally inflict some, any consequence on anyone for letting this repeatedly happen. Perhaps the battle we're losing is, at some deeper level, with the very physics of civilizational energy distribution and consumption, aka, with societal entropy. In which case... Yeah, that battle seems pretty heckin' losing to me. Good thing identity theft only seems to happen to "other people."

I know this argument is going to ring pretty hollow and the irony will bite me pretty hard if I get my SSN highjacked literally tomorrow. Which, thanks to Equifax in 2017, could theoretically happen any minute now! Just like it could've happened any minute now for the last 9 years!

But then again, even if and just because I suddenly personally care a lot more about this issue because I'm suddenly affected by it, that doesn't obligate you or anyone else to feel the same way.

A certain kind of indifference toward the suffering of others might be civilizationally efficient. In which case it might be absurd and maybe even ethically problematic to care in aggregate any more than we happen to do.

Literally, who's to say?