If there is negligence involved, yes - an insecured building being broken into can absolutely have legal consequences.

That computers are involved should not remove negligence as a possibility to recover damages.

It depends, in a regulated industry if you fail to do stuff like install a commercial firewall, keep facilities secured with proper door locks, etc. you may very well face fines or loss of a license to operate.

I think when people talk about consequences, they’re not regarding these companies as victims of crimes, rather as negligent actors.

> By that logic should there be legal consequences for a company if someone breaks into their office and steals paper records?

Comparing cloud storage and paper records is worse than comparing apples to oranges; it's comparing apples to celery. Sure they're both edible but they are vastly different organisms.

And yes, there can be legal consequences for a company if someone breaks into their office and steals paper records.

An analogy of an analogy. Could somebody go one level deeper?

Comparing the original statement to the subsequent analogy is a bit like comparing an apple and an NFT of an apple...

There already are consequences. Auditors will check the physical security of your office buildings if you're dealing with anything sensitive. If a breach happens later on and it turns out you cut corners on that physical security (or even somehow unwittingly compromised it) then you're not going to have a good time.

If we're into bad physical analogies, I feel a better comparison would be the company itself sending an indexed copy of the records of all their clients and relying on ethics alone to keep someone from reading others' data.

You mean like in bailment? That's a thing.

This is more akin to leaving the door unlocked than to having a break in.