Major firms are failing to learn from Equifax breach