This is a political problem. Until we pass laws that companies can be find liable for significant damages in the event of data breaches, we will see little progress on data security. This is an area where Congress needs to act. Current law does not adequately protect the public due to the difficulties in establishing standing, tying specific breaches to specific personal damages, other reasons.

Such a law would seriously impact current practices of the majority of IT firms, including small app developers, which is why we see little push from silicon valley for such changes.