There is a word for this, negligence. We need to start considering these failures to secure user data as criminal negligence.