This is just adding more crimes to the indictment. Start prosecuting companies for the things the systems they run are doing and the problem gets solved quickly.
My uni got hacked, but the data is conveniently handled by a third party with 3 employees who just declared bankruptcy, and no one had to pay anything, and there was a new 3 employee cloud form popping up who could be the new vendor.
The software world is run this way