There should be such thing as "gross negligence" when it comes to security. If believe it applies to companies managing "critical infrastructure".

But, fortunately for Equifax, companies that manage social security numbers haven't been declared critical infrastructure. If they were, I'm sure Equifax could have been found guilty of gross negligence.