They should be subject to independent security audits for the next X number of years in addition to the fine. It would only take a few companies having to go through this before budgets stop getting cut in IT.