Companies' fear of class-action lawsuits: incentivizes lawyers to pursue cases without actually benefiting victims much
Companies' fear of reputation loss: this is only the case if incidents are rare
Harsher punishment for ID thieves: incentivizes thieves to hide better or not commit a crime
Harsher penalties for individuals' security gaffes: how do you even propose to do this?
Individuals' vigilance with password & data security: need to provide incentive for this, especially when personal responsibility is diminishing
Nothing much: it's just an inevitable tide to endure: only the best option if all of the other options are likely to make the situation worse
I'm going with harsher punishment. While people do need to be more aware, the key is to create incentives for thieves to NOT steal. In an ideal world, the punishment for a crime should be strictly greater than the expected value of committing the crime (of course conditioned on the probability of false conviction). Obviously, such things are not easy to measure...