Imo you need to recoup all profits and all wages above minimum wage for the last, say, 3 years. Give the company chance to continue, but ensure this prevented any financial benefit.

It's like the old story about juniors deleting prod databases, or whatever, you don't want to fire them when you've spent so much on their 'lesson' not to do that again.

You'd also want the company to pay for independent auditing of their security going forward.