The thing is
it wasn't people who gave their personal data to Equifax - it was companies selling financial products. In a just world, there ought to be some liability on them too. They didn't take steps to ensure that they were handing over our data to someone who was taking the necessary steps to secure it.
Yeah, I know there's no chance of this happening.