AT&T has had a major data breach. Should the government pass laws that punish companies that have major data breaches and also force compensation from the companies to those that suffer from the release of private information?

Here is a link to the article:

AT&T data breach: Millions of customers caught up in major dark web leak https://www.bbc.co.uk/news/world-us-canada-68701958

Personally, I think companies generally do the bare minimum for cyber security in regards to customer data and that we cannot rely on them to have our best interest at hearts.