Breaches like this need to have legally enforceable punishments. Things such as mandatory recompense for each and every affected user, plus a fine. Too many companies are lax on their IT security because they don't want to pay for the staff to maintain the systems required. Make it more expensive to have a breach than to pay the IT people to monitor for it...otherwise these breaches will continue.