You mean as a criminal penalty? I'm against it. They're already civilly liable for the harm done to their customers by allowing the data to be stolen. A criminal charge should only be brought under current statutes, if the company's complicity in the theft warrants a criminal charge.