Despite decades of hacking attacks, companies leave sensitive data unprotected

1. The re-framing by financial institutions of them being defrauded as "identity theft" and pushing this responsibility onto their customers.

2. Because of the above, the data can be valuable, incentivizing the compromise.

Re 1: Note that credit card companies have had this problem for ages and treated it as fraud for decades, which is why established card companies can have very reasonable processes to cancel transactions, mark some as fraudulent, and probably why they have reversible transactions. However, because of the rest of the industry card companies now appear to be jumping on board with the "identity theft" concept.

By collectively not treating it seriously and essentially letting it happen and inconveniencing their customers instead of the vendors, banks have essentially washed their hands of it and give zero incentives to the vendors to seriously try to protect the data. If every transaction marked fraudulent meant the vendor didn't get the money, there would be a lot more serious action here.

Sure, "has firewall" is pretty effective but how do you encapsulate how it should be managed effectively?

What happens when a system that was supposedly secure installed by a previous employee fails? The company's fault? How would they know? The employee's fault? Maybe they thought it was good but were simply wrong?

I think a more fundamental approach would be to set mandatory qualifications for IT workers/devs to ensure a base-level of security/understanding. I know great web devs who don't know about web app security - that shouldn't be possible. It wouldn't be perfect but it would be easier to do refreshers/regular testing for things that people should already have learned, just like train drivers do.

Politicians will say it’s the companies responsibility, and you should talk to them. Companies will say that they follow all data protection laws and that policy discussions should be up to the government.