Perhaps they were so successful at getting their clients minimal punishments that they didn't see a need to meaningfully invest in proper IT security compared to the inevitable slap on the wrist.