Have the C-suite hand back their compensation above minimum wage for the last 3 years. Fine the company, all profits, or a percentage of global revenue (and pay that back to customers).

If the outcome of ignoring data security is to not make any money then companies will actually do something about it.

Penalities should push the company to the point of failing.