This must be handled at the government level.

The cost of "losing customer data" is too abstract for a company trying to survive financially. Corners will inevitably be cut.

Unless the costs to be suffered by the company for exposing private or sensitive information are made very clear through legislation.