While I tend to agree with catastrophically steep penalties, there are perhaps unintended consequences. It wouldn't be hard for an APT type shop to breach just

While I tend to agree with catastrophically steep penalties, there are perhaps unintended consequences. It wouldn't be hard for an APT type shop to breach just about any average corporation using an arsenal of private exploits, fuck with their security configuration to make it look like gross incompetence, and exfiltrate the data to some seemingly-amateur front organization that actually leaks it. End result is you could have foreign actors knocking out their country's competition abroad, using their competitor's laws to do so. Not ideal. Maybe some determination would have to be made to avoid that, like a judgement rendered on the corporate culture. For example, is it obviously a cesspool of incompetence just in a general sense? Great, burn the company down. Does the company custom-design their own ARM hardware to at least have a fighting chance vs APT-type threats? Maybe they did everything they reasonably could in that case. You could also argue smaller companies did everything they could even if they don't have the resources for that, provided there's not rampant incompetence.