wait what?
CHS lost millions of records, was fined a few million (out of profit of 1.2 billion) UCLA similar. Bunch of others I don't think even got fined like Ascension recently lost all data in a ransomware attack
It's useful going after a rogue employee, but on an org level it's security theater