Companies that practice bad security and potentially expose sensitive data to bad actors should be fined or shutdown via the proper legal channels. In the more extreme cases, I think short jail terms should be considered for those responsible depending on the extent of the damage caused.