Start fining companies when user data is lost. News would report on companies getting fined for shitty security practices, which also makes it clear that the problem isn't hackers. Plus companies have an incentive to spend money on securing their data.

They tried. The Republican Party leadership suspended all investigation of Equifax. Equifax is part of the finance industry and the finance industry are major sponsors of the Republican Party.

They're major sponsors of both parties. According to http://fortune.com/2017/03/08/wall-street-2016-election-spen... their donations in 2016 split about 45-55 Democrat-Republican. In 2012, according to http://www.businessinsider.com/wall-street-responsible-for-o... they contributed significantly to Obama's re-election campaign.

If you really think the "finance industry" as a whole is what's pushing for the Equifax investigation to be shelved, then I expect the same would have happened under Democratic leadership.

One of the biggest problems I see is it is really hard to attribute an instance of Identity Theft to a specific breach. So you can't (as a reporter) go out and build stories about people directly affected by the breach to build awareness of the problem. People tend to ignore (or be ignorant) of the situation unless it affects themselves or the people they have relationships with.