This link has some great information that you may find helpful:
About Identity Theft - Deter. Detect. Defend. Avoid ID Theft
No institution can guarantee 100% that they won't be hacked. It isn't necessarily carelessness on the institution's part but rather a criminal hacked into their system. The insitution is also a victim of a crime. My DH is a security engineer and deals with this stuff on a daily basis.