If loss of customer data to outside attack was a crime ( pointing at company C-suites ) then very little data-theft would occur. Why are such laws not already in effect ?
Because if this were the case, then nobody in their right mind would willingly become a C-level executive. Without these people there wouldn't be a functioning company, so there would be fewer companies doing fewer useful things. Progress, heck even maintenance of what society has already figured out, would skid to a near-stop. This isn't the way.
A far better way forward is harsh financial penalties against companies for using less than industry best practices. Those penalties can come from either the criminal or civil legal system, or both. All but the biggest companies would purchase malpractice insurance to cover this eventuality, and the insurers would get very good at pricing the policies based on risk analysis and audits of company practices. The biggest companies would self-insure. No matter how it's accomplished, it would be in each company's best self-interest to minimize the financial impact by improving their practices. This wouldn't fix everything, but if the legal system turned the financial pain dial up high enough, it would make these occurrences far less frequent. The trick is finding the right combination of penalties where you don't put a small local in-home pet euthanasia non-profit out of business for accidentally exposing a half-dozen customer records on their web site, but there's enough pain that the biggest of the biggest companies take it serious as hell.