Their security track record is equivalent to a bank storing its customers, partners and employees crown jewels in a wooden bikeshed with no doorlock. Repeatedly.
Stomping your feet, blaming evil North Korea and launching lawsuits against unrelated bystanders may be a convenient way to distract the mainstream media.
But it's also completely missing the point and a little bit embarrassing...
Various employees have started civil suits claiming damages.
Their entire IT infrastructure was obliterated and they had to spend tons of money on IR and new security tools. So quite a bit of damage has been done already.
The part where they don't establish most basic protection at least for their critical customer data, after suffering from security breaches pretty much constantly[1] for over 3 years.
If you have an account with any Sony product (Playstation network etc.) then your personal and payment data (credit card numbers) have most likely been leaked not once but multiple times by now.
Why is Sony still allowed to store payment data? Why is their PCI certification not revoked?
As a layman I would argue that we know anyway that these kinds of laws are rarely ever enforced upon companies the size of Sony. Especially not when there's a political PR spin as convenient as "omg North Korea" (was: "omg terrorists").
However, the least that they have obviously violated (on multiple occasions) are the PCI-DSS diligence requirements and probably every data protection act under the sun.