The letter does state that they will provide credit monitoring, with details to arrive under separate cover -- but you are correct that the mitigation burden is increasingly on the victim. It does seem as if there is now a de facto data-breach process that has a very low cost to the breached party.
If one wants to stop breaches, the cost of remediation needs to exceed the cost of protecting the data in the first place. Perhaps, legislating a check to each victim instead of just a letter.
