It's less analogous to accidental customer data leaks and more analogous to running a phishing operation.
When their user data eventually leaked, it resulted in countless lives and relationships ruined and at least a handful of suicides. While civil lawsuits have been filed, I haven't seen any talk of criminal charges.
Jail is a bit much for a negligence-caused data leak, but I certainly would welcome large fines against companies with shoddy systems. It might incentivize c-level execs to invest in properly securing their systems and the rest of the organization to take security seriously.
These financial crimes weren't the result of negligence. They were committed by people who knew what they were doing and profited handsomely from it.