Think carefully if you care how someone stole the data. Or you care more about how likely it is to steal the data. I can argue that penalizing companies for being blackmailed in fact encourages less cooperation with authorities, which encourages more people to blackmail them