Companies like Sony make claims that their Intellectual Property is worth X amount in court and go after individuals for huge amounts of money. I think you could argue that people's Personal Information is worth at least X + Y more.

If someone takes them to court and a huge, ridiculous, judgement is handed out, then maybe these companies will think twice about securing their customers data. Seriously, unencrypted password fields? A SQL injection?

Of course, I'm just dreaming.