That being said, it's important to understand that in the US, penalties are assessed based on the seriousness of the infraction, not on the ability of the perpetrator to pay.
And while it might be the opinion of lots of HN commenters that the equifax breach caused "incalculable" harms, demonstrating this level of harm in court would be tremendously difficult.
It's not about ability, it's about whether the fine is a suitable punishment and deterrent.
When the penalty is less than $5 per person affected, how am I expected to take that seriously? A penalty based on the actual seriousness of the infraction would put the company out of business, and that's what should have happened.
% of revenue doesn’t work because some companies are high-revenue low-profit (supermarkets), others are low-revenue high-profit (luxury goods). % of profit doesn’t work because profit is fairly arbitrary (if a company reinvests everything, then zero profits). Cash on hand is even more arbitrary.
But % of market cap tells us exactly the impact on owners, it’s literally the amount their stock is going down and they’re therefore being penalized.