I’m less shocked than I should be. National ID registries can be incredibly convenient, but when something goes wrong, it can go terribly wrong. Despite my general misgivings, I hope the IT company is visibly held accountable.
Most companies have open internal directory services, you can see who works there and contact them easily. Why should that not be the case for entire societies?
David Brin was on to something with "The Transparent Society".
Imo you need to recoup all profits and all wages above minimum wage for the last, say, 3 years. Give the company chance to continue, but ensure this prevented any financial benefit.
It's like the old story about juniors deleting prod databases, or whatever, you don't want to fire them when you've spent so much on their 'lesson' not to do that again.
You'd also want the company to pay for independent auditing of their security going forward.