We have entered an age where online security is paramount. Too many companies (especially state and local utilities) have far too lax security standards, and need to have motivation to update them. Utility companies usually have a local monopoly, so they have no incentive to update their systems to have actual good security. An example of this is a "maximum password length". Encountering this often means they are storing online user passwords in plain text, meaning that their database is ripe for being the next big password leak.
A set of standards for security should be created and maintained, and a series of audits and fines should be created to incentivize such companies into actually securing their user's data. These measures need not inconvenience users, but will secure them.