I think what regulators should start doing instead or on top of of inflicting monetary fines is to force companies to mint a significant amount of new shares a

I think what regulators should start doing instead or on top of of inflicting monetary fines is to force companies to mint a significant amount of new shares and put them in escrow accounts, then in case some future event happen (security incident meeting some specific criteria for a catastrophic incident), the share should be put on sale at market price and used to refund the affected customers and pay for the regulatory costs. In this way, executives and policy makers have a harder time moving on and not being accounting before the effect of their bad decisions is apparent, because the reputation for sharesholder value destruction could haunt them. Executives will be incentivized to create a better security culture.