I agree it could help to look at legal changes, such as 'massive fines'. That's closer to the 'rethink' we need.

In regard to human error, I think we are approaching the point where it is useless to focus on individual hackers, companies, admins or users.

To pick the most famous example of something we should rethink (not that it would address the hack in this news story): users on the web mainly read text, yet our browsers enable Javascript by default.

To me it seems the ways we store and share data in IT are starting to fail. It's at the point where every interaction a regular person engages in (with banking, shopping, healthcare, social life, work, education, etc) has a real chance of becoming public. That's not sustainable.