Comment by edent

> I wish there was a law that assigned a dollar value to different types of PII leaks

There is. It is called GDPR.

Plenty of companies have been fined for leaks like this.

Some countries also have whistleblower bounties but, as you might expect, there are some perverse incentives there.