A quick Google finds several people that have been successfully prosecuted for security negligence, like Joe Sullivan of Uber.

Most haven't seen criminal prosecution, but many do see civil prosecution and even more common is some sort of deal with prosecutors to avoid both.