Then you need to make it illegal to know of a breach and don't report it. This might give employees incentive to report their management illegal act of hiding a

Then you need to make it illegal to know of a breach and don't report it. This might give employees incentive to report their management illegal act of hiding a potential breach by obstructing internal investigation. Or better make the consequences of failing to secure system very painful and may put the company out of business. Not that 12 month of free credit monitoring for affected users. This will encourage companies to secure the data or better to not store what is not absolutely unnecessary because it is a huge liability. But of course governments like to access these data themselves from time to time.