Identity theft protection doesn't do anything, it isn't even "protection" just notification after the fact and some agent will hold your hand.
Instead how about companies have complete financial liability? That way they'll need insurance, and their premiums will skyrocket if they get breached.
If the market would bare a higher cost they would have already charged it. This can only hurt them, through competition, or just that people won't pay a higher price.
Or they'll move their business to providers that can operate at lower cost because they have more secure operations. They point is to expose the insecurity as a cost.
Instead how about companies have complete financial liability? That way they'll need insurance, and their premiums will skyrocket if they get breached.