Have the standard penalty for if a third-party discovers and reports the breach. Reduce the penalty if the breached company finds and discloses it themselves. Increase the penalty if they knew about the breach but did not disclose, and give the difference to the whistleblower.