Cyber incidents like this highlight the need for tougher action on companies that fail to adequately protect consumer data.