@0xabad1dea @GossiTheDog I've advocated in the past for this type of liability; more broadly phrased, dereliction of a public trust should be indictable on the rationale that between the hacker and the large corporate defender, one of these is much easier to deter.

The flagrantly negligent defender in whom public trust is placed also profits from their misdeeds. So the idea would be to fine e.g. banks who do things like lay off all their security teams and then get hacked.