Could lead to actual legislation which IMO is needed. If companies like this fail miserably to protect data it's a sign something bigger is needed and missing. It's like the how Aurthur Andersen represented how accounting firms should not act, and failed miserably.