imnewhere

Yes, and basic information security involves weighing the cost of security breaches vs the cost of implementing security measures.

I think you're going to need to define what a ruined life is. I doubt getting a replacement credit card in the mail will ruin someone's life under most definitions.

Why wouldn't they? I imagine there's some driver signup form that saves to some database table on their site.

I mostly agree, but the calculation is different for different businesses.

The costs of engineering time and hiring a security professional may be much more expensive than the lost business due to breaches.

In this particular case they likely have enough resources to have made it happen, but it remains to be seen whether this will actually cost them much if anything.