[9712263]

Actually, leaking customer information does not really matter to the company. What the company cares is the leak itself is not their fault. They just want someone to take those responsibility, so putting in 'Someone Elses Computer' is actually a good strategy.

Only when losing customer information equals to revenue drops, company will take security more seriously. Enforcing a law to company storing customer to have common security practice is a possible solution, though it hurts low budget startup.

[pilsetnieks]

It would in Europe under GDPR. If your subcontractor leaked your data, you are at fault as well, for improperly vetting your subcontractors.