Part of the problem is that the US has no unified empowered cybersecurity regulator that I'm aware of.

As a result you get a mishmash of DHS + DOJ + SEC + HHS agencies.

If there was one single throat to choke that had remit for cybersecurity + ability to being cases and assess fines, they'd be handing them out left and right.