[sp332]

I would put it the other way: if you can't afford insurance to cover the potential damage you're doing, then you're not allowed to do it. And I don't mean unforseeable events, I mean something obvious about your business, like creating a single giant repository of data about other people and then not securing it.

Of course the hackers are directly responsible for the damage, but Equifax's negligence sure didn't help. Maybe a fractional multiplier for sharing responsibility.

[inetknght]

Then who insures the insurers? Are insurances the next "too big to fail" type of companies?

[sp332]

Since the insurers are collecting money from lots of companies, maybe even from different industries, the odds of that happening are a lot lower.