Canada's still being fed the low numbers bullshit by Equifax claiming that only 8000 people were affected.
Yup, pull the other one.
We need a category of criminal or civil law that makes it possible to go after the personal assets, trigger dismissal, or even send to jail executives that commit gross negligence during the carrying out of their duties. A company might be guilty but the problem is that these folk can cash out on bonuses during the years that their bad decisions inflate profits. And, then, at worse they get a gold parachute to ease their way out and their successors and company staff are left to deal with the mess.
So to keep these folks honest, you need the possibility of personal losses, not just the certainty of gains when they game the system.
That goes for anyone in the Equifax executive decision chain that under-budgeted their security systems, if that is proven to be the case.