The information contained in that data breach is worth substantially more than 2.5 million to many different groups lurking in the underbelly of the internet (and in real life). There is no guarantee that these hackers haven't already made arrangements to sell the data anyways after collecting the for sure 2.5 million in bitcoins. Just a sad, sad situation.
The American citizen again gets punished because companies didn't go the extra mile to secure all security flaws. It was really only a matter of time for this to happen given how much data companies collect and the type of data this company, Equifax, collected. Hot target.
The internet and complicated digital security is still in its infancy. One can only hope that the future has a much better outlook and not too many people get devastatingly harmed from this.