I think the most feasible solution is to make companies liable for damages, not in a light way but rather that every person can sue (or in a class action) for hefty amounts, so that a breach could cost e.g. 100mil+
that should incentivize them to actually invest some money in security. right now its just tiny numbers which are easier to just pay off and forget about