To my knowledge there are very few negative consequences, outside of the immediate and obvious ones like reputation, that actually occur when companies leak customer data. I suspect they won't regard keeping vast troves of customer data as a liability until that changes.