Equifax securities fraud class action [pdf]
This is quite strong policy. Usually in most sinister incompetent companies, the user name is "admin" and the password is "password".On a serious note: there should be a mandated, periodic, third-party security audit by neutral parties for all entities which deal with user data beyond a certain specified level of sensitivity. It should not be left to their discretion when to run such an audit from their end. Whether an entity similar to SEC for the stock exchange is desirable can be debated, but the current laissez faire approach to data will lead to even more such disasters.