Well this is scary. We should see more concentration on privacy/security at the mediocre tech companies (because engineer pay is a decent indicator of privacy standards and security strength), ISPs, health care companies and financial companies. They have very personal data and many of them actually sell the data (and apparently even unanonymized data).

I feel that all the talk of privacy at the big tech companies like Google, FB, etc. is unwarranted compared to the threat. They have solid security and don't actually sell data. Letting advertisers target viewers based on demographic data is different from providing anonymized data to people and they have policies that make sure that advertisers can't get too narrow with their targeting.