Really makes you wonder - how can a company like this not take sufficient steps to protect this data?

(And there'll be no consequences--if it was a hospital, there'd be huge fines)