I have been saying that companies that wish to collect and store private data should be forced to buy "data insurance" for this purpose and to incentive only storing necessary information

There are lots of shady lawyers out there, and this would give them an incentive to pay hackers to increase the size of data breaches.

Indeed. Seems like a cobra effect situation: https://en.wikipedia.org/wiki/Cobra_effect

But it wouldn't be a reward. It'd be a fine paid to the government. The only real reason with malicious intent I can see from it is people intentionally hacking companies to bankrupt them or cripple them. But that just means they had weak security anyways

The OP was talking about class action lawsuits. The plaintiffs in class actions are individuals, not governments. I took that the mean the OP was talking about penalties to private actors, rather than to governments.