Most federal cases are about negotiating the sentence, and win a public defender she is probably screwed. She’ll spend more time in prison than the average rapist.
This argument is constantly made on HN and it is analogous to; you left your back door open at your house, and instead of arresting and prosecuting the robber, we are going to arrest you. Sure, I made a mistake and left my back door open, but that doesn't give the robber the right to break in and steal my stuff. It is lacking a moral compass and sense of right and wrong. There needs to be consequences for bad behavior.
I admit the Equifax situation was worse. The people whose data was lost by Capitol One probably at least have some sort of business relationship with that company (for example, they may have applied for a credit card). I had no business relationship with Equifax at all, yet apparently information about me was leaked. I don't buy anything on credit, so I don't give a tinker's damn what my credit score is. Equifax provides no value to me whatsoever, yet I now have to worry about information they collected about me with no authorization from me. I'd like that company to be sued into bankruptcy.
We need to start putting the hammer down on these people; maximum five years, meaning she/he will probably do one year. The US needs to start making examples and these people and increase penalties.