Why not make it a criminal offense for companies who don't take reasonable approaches to preventing such attacks in the first place? We place a lot of trust in companies that hold our personal data (e.g. Equifax), and I'd argue there need to be harsh penalties. The tools exist and guidelines are clear.

It shouldn't be the criminals penalizing them, but here they are filling the gap that the regulators ignored.