Because there is no liability.

If they were fined $10k per leaked ID, then there is a serious liability there.

Right now, they publish a press release, go 'oopsie poopsie', maybe have to pay for some anit-fraud things from equifax if someone asks, and call it day.