Seems common in the US of A$$, if data stolen, to offer a couple of years of so called "protection" with another dodgy company and they get off with a minor slap wrist. Hope the employees do a class action lawsuit, companies need to be punished, to fulfil their security obligations. UK/EU DPA/GDPR may not be perfect but offers more protection and our watchdog is finally starting to wake up and punish companies. Just waiting for the first %% of global turnover fine !!