 Serious considerations should be given to applying significant penalties to the persons running these large firms in cases where reasonably foreseeable situations permit these breaches but aren't dealt with before large numbers of customers are negatively impacted. It's not even as if most of these breaches are the result of novel or dramatically new types of attacks. Mostly, they seem to be garden-variety credential theft resulting from email phishing and the like. Same sort of stuff that's been going on for many years now.