It's far too common now and there doesn't seem to be any meaningful consequences for the websites/companies involved.
As long as there are no serious consequences for leaking user's data these things are going to continue to happen.
Edit: I’m not sure I’ve ever heard anyone suggest “regulatory capture” as a reason to not levy fines against companies who held breached data. HN discussions on this topic seem to trade in the same repeated points—“identity theft” is bank failure/fraud masquerading as the customer’s problem; there should be consequences and/or fines for the party who held the data; the frequency of breaches should make us rethink how private PII really is; etc.