Target lost tens of millions of credit card numbers and paid just over $18 million to settle every lawsuit against them.

People seem to conflate the way they think things should be with the way things actually are.

Exactly. The costs to EFX will likely be <$100M all out, after all the torch-waving and yelling. Equifax net profit in 2016 was $488M.

Longer term, this is actually quite possibly revenue-positive for Equifax - they will trick a non-inconsiderable number of people into signing up for their credit monitoring service, and everyone who wants a credit freeze gets to pay $10 (in Illinois at least). That's $1.45B in potential revenue right there! Once Transunion and Experian see the success of this ploy, they may have strangely poorly secured border networks of their own set up invitingly for the retail hacker...

While I agree with your second statement, losing SSN and financial information is vastly different from losing credit card numbers. If my credit card number is stolen, I have to get a new one, and call the bank if any transactions show up before the new card comes.

If my SSN and financial history is stolen, someone can impersonate me. They can sign up for bank accounts, loans, credit cards, etc.

This data is far more valuable and damaging than a credit card. Credit cards are easily canceled and the public has zero liability.

How many warnings do they need?

Well, the other two credit agencies would be a good start...