It’s frustrating that there are no consequences for companies and organizations that don’t have enough security/know-how/motivation to prevent data theft. Would it make sense to have a law that would penalize leaks and theft?
Admittedly there are some macro effects that are causing security to be taken more seriously by companies in general. The proliferation of compliance programs especially SOC2 had made basic security the default for a large portion of b2b tech companies. Cyber insurance requirements are increasing. Newer state regulations and SEC regulations have pushed other companies to increase resources dedicated to security.
That said this is an uphill battle after a decade or so of companies having no security with passwords or SSNs in plaintext and everyone having access permissions.
GDPR has such provisions, if the company didn't do enough to protect the data. E.g. British Airways were fined for bad practices and because their website had a card scraper for multiple days which they should have detected.