Should be a fine every time this happens and a major fine if it was found due to negligence or not having the appropriate security measures aka yahoo. Yahoo leadership new they were understaffed, cut staffing anyways, got rid of any executive who disagreed, and got no penalty for their mistakes.
Make it more costly to get fined than it is to get hacked. Or some white collar jail time if it wss negligence or covering it up.
The GDPR will cover that. And those fines are massive. It's not going to be a magic bullet against breaches but the effect will definitely be that companies will start to see security no longer as optional or an afterthought but a direct liability if not taken care of properly.
Make it more costly to get fined than it is to get hacked. Or some white collar jail time if it wss negligence or covering it up.