This is exactly what will happen in Europe next year.

With the General Data Protection Regulation, any leak of private data caused by a major cybersecurity gap in a company will lead to severe financial sanctions such as a fine based on 4% of the company turnover.

This law will indeed give the risk a “cost” :).