I wouldn't be shocked if those services are compromised.

There is no reason for things to change if the liability is not on the company that loses the data.

However, the IRS assigns $0 to data. So long as that's the case there will be no liability.