> "If these kinds of breaches were actually costly, then people would indeed treat PII as toxic."

But they are costly ... just not to big business or government. They couldn't give two flips about our misery.