Every time I read about one of these avoidable breaches, I feel tempted to gin up a class action lawsuit and force a company to either write a painfully large check to acknowledge the time and trouble it has imposed on its customers - say, about $5 each - or sell itself to its users in lieu of money. I'm not actually going to go to that effort, but sooner or later some enterprising law firm will, and I'm sure everyone here is going to be all hand-wringy about it.
We need to automate security and make it customer-centric. It is plainly too complicated to be left to individual web service providers, just as brick-and-mortar stores do not manufacture their own door locks or burglar alarms. Vendors, if you feel you can't safely outsource this job to a third party, then you need to hire full-time security monitors and start facing up to security as a line-item cost rather than a check-box you can forget about after you've put it in place.
Sorry to be ranty, but when established firms are losing millions upon millions of passwords literally on a daily basis, something is drastically wrong with the state of the art. This is a problem that can't be prettied away with CSS or smoothed over with a few tweets and blog posts.