1. It should be illegal to run insecure services. Massive Fines.

2. The payout to the hackers should form part, but not all of the penalties. Pay those guys for their great service to humanity they earned it.