We as a country need to start treating PII as radioactive - that touching it or keeping it anywhere near your computer network is a company-ending disaster about to happen. The legal standard needs to be strict liability like CSAM or DUI.
Well, that would require such leaks to result in a company ending disaster. Instead they keep chugging as normal and the customers who got their information leaked don't even move off the platform for greener pastures. What a boring dystopia we live in.