This is why the idea that we can trust the market to regulate itself is completely ridiculous.
But not a cost or negative consequence to the organization that the data came from
Data breaches have significant real-world harm. Unfortunately Equifax got out of this without paying fines in several state at least. It was the regulators who failed us here, not the market: https://www.reuters.com/article/us-equifax-states-agreement/...
Customer data should be like radioactive waste. Companies should know that if they have it, they have to take appropriate measures to secure it, and if they don't they will take a significant financial hit. The financial penalties should be significant enough that if a business doesn't feel sure they can invest into proper security, it makes more sense to just not keep the user data.
On the contrary: the credit reporting industry is a perfect example of market failure thanks to regulatory capture.
The actors in the market exercise a high degree of control over the regulators. The regulators are not independent and the companies that influence them are not innocent.
All markets are constructed. The credit reporting market is just set up with rules which are grossly harmful to individuals.
Regulators should answer to the people, but because corporations are extremely motivated, fabulously wealthy, and privileged by the court system, the people have to compete for the regulators' attentions. I think it makes sense to acknowledge that Equifax is acting against the common good, even if that's just incidental to Equifax acting in its own interests.
There are no significant regulatory penalties coming at Equifax over this (the biggest change is that credit freezes are now free, which is great win but won't have a huge market impact).
Additionally, consumers can't choose not to participate in this process. I mean, if you're wealthy, you can choose not to buy anything on credit, and if you're tech savvy you can choose to freeze your credit with Equifax and force the majority of your traffic through other companies. But again, that's not the majority of the population and it's not going to have much of an effect.
Businesses aren't going to stop relying on social security numbers and background checks, because... well, for a lot of reasons, but partially because that system is really entrenched and it would take more than leaking half of the US population's data to make it change. That's going to be a very, very hard battle to win. In the meantime, that just means its even harder for consumers to avoid businesses that rely on Equifax for credit checks.
So, the market determined that consumers were not going to change their behaviors over this breach, in part because there aren't a lot of reasonable ways for consumers to do anything. It determined that Equifax wasn't likely to be harmed in the long term by the government, and it determined businesses weren't going to change their behavior around identity verification -- and it priced itself accordingly.
If you want the market to punish bad actors, you have to give consumers and people effected by the market agency to move their business or to choose not to participate in systems they don't like. Current credit systems just don't give ordinary consumers that kind of agency.
This also pops up in privacy debates sometimes where people say, "oh, people don't care." That's sometimes true, but it's generally really complicated -- and part of the reason it's complicated is because consumers have been taught over and over that there is no point to caring and nothing they do is going to stop companies from tracking them.
Markets with true competition can only be sustained through continuing struggle, because companies hate competition and constantly innovate new ways to capture the regulators.
The best we can do is regulators who retain their humility and exercise a light touch.