From your link:

> ...the judge noted that Equifax had a duty to safeguard information, failed to heed warnings from the Department of Homeland Security, and “willfully” violated the Fair Credit Reporting Act and state regulations.

IMO, ignoring government warnings and violating regulations is much different than failing to stand up to an attack.

I would be very resistant to making "being hacked" a crime - in almost all cases, the hackee is the victim of an attack. If you feel the need for legal action, we should increase our "anti-hacker" laws and enforcement.

We don't fine banks for being robbed. It's the robbers fault something bad happened, not the bank's.

EDIT: formatting