Are any victims calling for prosecution?

It’d be a waste of tax payer money. The companies who were hacked are just directly receiving restitution behind closed doors. Unless they are unhappy there’s no reason to bring the courts into it.

I completely agree that proper safeguards were not in place. But response is happening just not in public. Companies work problems out between their own lawyers all the time because it’s much cheaper, faster and easier to control the PR around.

Criminal prosecution can be done without needing the victims to call for it, and in this case I would argue it's necessary, as it will help ensure companies don't treat their act of gross negligence as "business as usual".