Attacker grabs data for 3.6 million South Carolina taxpayers; governor wants to see culprit "brutalized"

Attacker grabs data for 3.6 million South Carolina taxpayers; governor wants to see culprit "brutalized": She's got a right to be incensed, with 77% of the state's population's Social Security numbers being snatched out from under the Department of Revenue. But what's the appropriate penalty for the department, for the crime of leaving the data unprotected?