Customers are absolutely without blame here. They have no way of knowing which parties are and which parties are not running a tight ship. Every e-commerce store already handles your private data, how will you ensure that across all of those each and every one is going to be careful with your data? I'm not the most active online shopper in our household by a long shot and yet I've had two reported breaches in the last year alone, one a specialty welding store, the other a store for home automation products. Now, both of these are 'niche' and probably don't have a security budget to match their responsibilities. Even so I would have expected some basic precautions and that trust seems to have been misplaced. I expect each and every website where I've ever filled out a form to be hacked sooner or later. Nobody seems to do anything about blast radius reduction, which would be trivial. But marketing wants to keep the last 20 years of purchases live so they can send out some more spam, when what they really should do is move those records to cold storage for tax compliance only the moment the package is delivered.