Even just a fragment of someone's personal information can be combined with other data points in order to commit identity theft.

Other impacts may not have direct monetary damages, but could be even more devastating (ie Ashley Madison).

Until the courts start clamping down on negligent handling of personal data, firms will continue to cheap out on infosec.