That being said, we’d need to also make it illegal (with a bigger fine) to not inform customers of the breach, and to provide reduced damages for companies that promptly inform users. Otherwise the “correct” approach for a company would be to ignore every hacking attempt and never investigate.
Sure, but fining someone for leaking data is a very different thing than making them liable for damages, even if you call the fine "statutory damages".
It's hard to imagine anyone with half a brain working under such conditions.
It's also hard to imagine that putting such a measure in place would not result in data and systems being so locked down that they become unusable to most staff.
There needs to be real audits, with teeth, of computer security stuff - audits run in an adversarial way without the issues involves in financial audits. If you pass the audit, the fines should be minimal in the event of a breach.
Police misconduct gives rise to lawsuits. I'm sure one of the hopes of the plantiffs is that they change the system.
So, there is some precedent for lawsuits against public bodies in an attempt to change their behavior. I am somewhat skeptical about their utility in affecting institutional change, but there is definitely research on the subject and not just HN comments.
Fire the people responsible and make them unable to work for a district for five years.