Intent matters. Equifax's breach was a breach - they were attacked. They didn't intentionally post personal information publicly. It was behind a really shitty lock, but it was behind a lock. Facebook's was not, they knowingly & willingly did the things they are being fined for doing.

It bothers me that Equifax exists and is as shitty as it is. But it doesn't bother me at all that intentional maliciousness is punished harsher than incompetent negligence. The degree of the crime matters, too, of course, but this wouldn't be entirely dissimilar to the idea that homicide is a harsher sentence than involuntary manslaughter.