Until we see something like this,

The company is liable for $10 per hacked user minus 100X the bounty spend for that year.