Equifax failed at security because Equifax's leadership doesn't care. They will only be convinced by seeing revenue drop or incurring larger penalties from the government. Revenue will not drop because the affected people are not paying customers. Penalties will not increase because the current political climate is "All regulations are bad" when it should be "Bad regulations are bad; Good regulations are good."