 Serious considerations should be given to applying significant penalties to the persons running these large firms in cases where reasonably foreseeable situations permit these breaches but aren't dealt with before large numbers of customers are negatively impacted. It's not even as if most of these breaches are the result of novel or dramatically new types of attacks. Mostly, they seem to be garden-variety credential thefts resulting from email phishing and the like,