SEC now requires all companies must report their breaches on their filings. Maybe that should reflect also a way to hold companies accountable via some kind of fine based on a threshold of the damages done.
In the US only 1% of all companies are public.