It is unreasonable to equate "most people ... work at companies" with either a corporation that is an essential (obligatory) component of participation in modern society, or one with a value of $17.5B. Either and this breach would be fairly inexcusable, but both and it is really an egregious failing.

Most people work for companies with neither the data anybody would much care were stolen, nor the resources to secure it. Equifax had both, bigly.