If you have no choice of where to shop, and you have no recourse for making yourself whole when your only vendor abuses their monopoly power, that is not an “efficient“ free market.
Because that is ultimately the cover they use for all of this deregulation. “Deregulation hurts business“ is the only argument I have ever heard in favor of this kind of policy. But that is such an obvious lie at this point. That it seems they aren’t even trying t pretend policy has an economic basis anymore. But apparently the damage to the public’s ability to form an opinion has already been done.
I'm not sure that's a good argument for the free-market. We just have to suffer security breach after security breach until companies clean up? It seems like a total willingness to admit security failures in the first place where regulation could help us here.
And at the end of the day, there is some amount of basic deterrence for people who are not in some kind of adverse mental state. How many more crimes of passion would there be if murder, or assault, were not so harshly penalized? The “deterrence does not work“ line as a matter of degrees, not absolutes, and only applies to a subset of the population. For the rest of us, it works just fine.
So to re-join the topic at hand, think of it this way: there will always be outright criminal corporate actors, and deterrence by corporate death will never stop them. These are the Bernie Madoffs and Jeffrey Skillings of the world. Their corporate actors, however, only act the way they do because they are simply are no consequences for doing otherwise, and upper management has evidently quashed their consciences entirely: AT&T (selling deanonymized data with token, non-retractable consent), BP (Gulf oil spill), Equifax (not caring about your security). Lest we forget that these businesses are in the business of making money, and they do so with terrifying efficiency, and their management is soullessly shrewd. If something is risky and expensive because it entails a high chance of a lawsuit or some other penalty, they will think twice about it.
That is, the crime is conducted for direct financial gain (various black markets, theft, burglary, fraud), to defend a criminal enterprise (turf wars), to gain resources to feed some criminal activity (drugs and gambling addictions, especially), or as a consequence of economic marginalisation (people pushed into desperate situations, or engaging in activities on account of those).
(There's also a tremendous amount of white-collar and corporate crime which is never prosecuted, a whole 'nother story. The dumb criminals are the ones who get caught.)
Even various forms of tribalistic / hate crimes are often related (with varying levels of justification, having a floor of zero) to economic perceptions. As are crimes of passion or pride or reputation.
There's not a whole lot of crime that isn't at least arguably connected to some economic motive or dynamic.
That's the only way to send a message strong enough that if you are going to operate an IT business, which is what Equifax is, and you have poor security, you will not be protected by the government.
In fact, protecting Equifax and other companies who fail to properly maintain adequate security will send a message to other corporations that this kind of behavior will be tolerated, and these companies may be incentivized to not invest in their security. I've seen situations exactly like this play out at companies before. If the rules of the market suddenly change, so will the industry.
And why should we risk the stability of an entire industry because of one company? The security problems aren't going away, even if we decide to create laws that say they don't matter -- they will still be there at the end of the day, and someone will be able to exploit them. It's bad for business, bad for consumers, and ultimately bad for whatever government is foolish enough to create such policy.