Bankruptcy seems quite appropriate. They not only failed to maintain the security of the data, they also provided no identity theft protection to the public (unless you asked for it), and as a company appeared to have no plan for this event. Given that they were entrusted with the identity data for basically all Americans, that is inexcusable.