This is going to keep happening until there are some real regulations with teeth in place.

If your private data is leaked, the company responsible should have to pay you some significant amount proscribed by federal law, regardless of whether or not you've had your identity stolen. A leak like this should bankrupt the company responsible.