These companies have a responsibility to the people whose information they hold.
Yes, they have a responsibility but that doesn't make them responsible.
This is exactly why I don't buy anything any more from sites that don't support escrow services. This happened about ten years ago, but... a couple of weeks after using my visa card to buy a book on Xbox hacking my card details were used to buy about US$500 worth of stuff from the Harvard University book store. It took me about 9 weeks to get my money back from the bank, I had to cancel my card, etc.. Being my only credit card at the time it was a huge inconvenience and I was still liable for interest on the funds despite it being a fraudulent purchase (wtf?). Nowadays if a site requires a credit card to purchase something I'll shop elsewhere. And forget about putting correct birth dates and tax file numbers online.