There are extensive laws in place that protect the personal information of patients and students. If a hospital had this same issue, then it would be fined and depending on the state, it would have to inform all of it's users that it may have leaked personal information. Similarly, educational instituons will not share your educational record with your parents no matter how much they beg unless you're a minor.

It's not a stretch that there should be laws that affect all companies that collect data on their users. I hope it happens soon! These companies should be paying quite a bit in fines for these mistakes, not just a few thousand for a bug bounty. Otherwise our personal information will most likely leak and be all over the web.