"It won't stop until fines for all breaches where data was taken having not been properly secured are eye watering to the point of making shareholders really feel the pain."
Define properly secured?
is there some accreditation they need to meet before they can be fined? I'm fairly sure their accreditation boxes will be found to be ticked, including insurances to cover their costs in this kind of event. the insurance wont cover the cost to their reputation though which is what will truly heart them.