It depends, in a regulated industry if you fail to do stuff like install a commercial firewall, keep facilities secured with proper door locks, etc. you may very well face fines or loss of a license to operate.

I think when people talk about consequences, they’re not regarding these companies as victims of crimes, rather as negligent actors.