New attitudes and new legislation are needed.
Perhaps it is time to stop the processing of personal and other sensitive data on internet connected computers. That is, until the makers of IT systems actually start producing secure systems.
If system operators were required to pay realistic compensation (a few thousand Euros, say), to each victim of personal data "theft", things would very quickly take a turn for the better.