Surely they should be held responsible for whatever happens as a result of that.
But how does an individual demonstrate damages to a judge? Equifax leaked data on more than 150 million people. If a hypothetical business leaks data about an individual today, there is a good chance that data was already leaked by Equifax. So what additional harm did that hypothetical business inflict on that individual?
The discussion we need to be having is why it's somehow the consumer's fault that their data was leaked. Someone can find your SSN and other private information in a leak, dupe a bank into giving them cash, and now it's your responsibility to resolve this situation? How about the banks figure out a better identity verification system that allowed a bad actor to open the account in the first place?
1: https://finance.yahoo.com/news/people-successfully-suing-equ...
I don't know what to sue over that would harm them enough to make it worth my time. And I am extremely vindictive about credit bureau bullshit. I don't care if I benefit from the lawsuit, I'd do it purely out of spite if I thought they'd notice.