The book that is mandatory reading at every data collection and aggregation company
@jeff securing your PII doesn't directly make you money, so no effort is devoted to it
@mamizou not protecting it can be directly related to the loss of money via contract loss, class action lawsuits, bad press, etc..