On another note, (in response to the OP's "will it never end" question), no.
As a penetration tester (someone who is paid to break websites to find the flaws before a malicious hacker is) I can tell you there are many companies that don't bother getting a security report and many more that once they've got one, don't act on the information within because it's going to cost too much etc. This is basically handing their website to hackers on a plate.
There is always going to be hacking/phishing/malware but steps can be taking to protect against it and minimise the impact. Unfortunately not everyone takes those steps which is why we end up with a lot of these breaches.