I’d argue, oddly, that it’s easier to hold a single corporate entity accountable for data breaches than mastodon instance owners.

It’s likely the case that both of are bad from a data security point of view, but at least with the corporations you know who to shout at.

I'm inclined to agree, albeit I'm of two minds about it. On one hand, singular entity is technically easier, but being corporate means it's likely to have more wealth/resources to make it untenable for people to hold accountable. Whereas on the other hand, if you put in the effort to pin down a Mastodon instance admin or even a few admins, chances are they won't have those kinds of resources to really defend themselves, so you may be more likely to hold them accountable.

That is, compared to a corporate entity which may drag things out for a slap on the wrist settlement/fine or the like. I can see the different angles to where you're coming from though.