Do you know what possible fines or other consequences they could be facing? I'm really corious about that.

(this paragraph does not refer to NDPR or Nigeria) I have a general impression that very often the possible fines are far too low and it could be perfectly sound business decision to ignore the security or just keep it to a very minimum. Why spend a lot of money on auditing, improving the software, buying additional infrastructure when the cost of ignoring those and even the probability of anything happening is relatively low. For example why spend hundreds of thousands or possibly millions of dolars on security when the worst thing that could happen is a low fine with a marginal probability of breach happening then being discovered, then being reported, then being investigated and then actually a legal action actually being taken.

My point is that it might actually be a lot cheaper to face the consequences of a breach than to improve security. I'm not sure what could be done to improve that situation.