>Fines should be higher than the cost avoided, or companies would just avoid the cost until get caught.

Again, how much do you think Equifax saved from skimping on security? Sure, spending $575M would have prevented the hack, but how much did they have to spend to be considered not negligent?

Enough to keep it from happening or enough to make whole everyone who was injured.

Again, it's not about what is saved, it's about what it caused. If they can't expend a bit extra to avoid damage to millions of persons, maybe they shouldn't be in that business.