I'm not sure how that happens. Equifax basically exposed everyone in the US with any credit to identity theft and scams. If those thefts trickle out bit by bit over a few years, there will be no single, shocking crime wave, and nothing will happen. It doesn't take genius-level criminals to avoid creating a big enough incident.
On the other hand, I would be curious what would happen if some public-minded hacker stole ~150m people's data from one of the other two CRAs, then publicly released 538 specific records...
Credit firm customers aren't the victims.
The generalized GOP party line is that this kind of thing is better left to private enterprise and the federal government shouldn't spend time and money coming up with some sort of identification strategy.
So what business has the motivation to spend that kind of effort? Google or Facebook?
It's kind of a perfect storm of sorts, there isn't any pressure to fix it, anywhere. The public has even lost interest in it, for the most part.
Whelp... this is who is deciding what gets done in pretty much all cases.
But, in the case of IT security, their experience and expertise is, at best, not helpful.
"keeping customer information secure" is not a binary. Most companies that are breached don't know about it until their dat hits the black market. Yahoo! revised their data brach estimates upwards half a dozen times from 100million+ to ~3billion+. The plaintiffs would have to affirmatively prove that a breach happened to the defendant when most defendants don't even know that it happened.
It is even harder to contractually enforce when the victim claims it was a nation-state-actor/APT since no company could hold out against a determined APT indefinitely.
I'm hopeful that cybersecurity insurance policies will move the needle towards accountability and increased prevention (insurance policies will require good-faith efforts at security policies+procedures+tools+employee actions or they won't pay out).
If it were possible for all of the affected to individually sue Equifax, many of them already would have.
But the US civil-legal system requires "standing", which in turn requires proof of "damages". The sad fact is that loss of sensitive information is not quantifiable as "damages" for this purpose, even though that same information is worth well north of $millions when the FEC looks at the same kind of information transaction in election campaigns.
"The markets" that fiscal conservatives love to talk about don't work when our civil system doesn't recognize that there is value and a market there.
If the data breach had resulted in masses of data being traded on the black market, the Equifax breach may have ended in prosecutions and massive lawsuits. Because it didn't, it likely won't end in much.
Hell, not even the banks, retailers, and ID security services that did business with Equifax bothered to make a big deal about cancelling their contracts+relationships. The sad fact is that there's a tiny pool of companies with this data and cutting off one company gives the other players (who aren't much better at securing their networks) massive leverage.