Should be a fine every time this happens and a major fine if it was found due to negligence or not having the appropriate security measures aka yahoo. Yahoo leadership new they were understaffed, cut staffing anyways, got rid of any executive who disagreed, and got no penalty for their mistakes.

Make it more costly to get fined than it is to get hacked. Or some white collar jail time if it wss negligence or covering it up.