Petty criminals are not the only black hat hackers that exist. An immediate monetary payout is not the only motivation for breaking into the computer system of a service that's essential to society.

If we're unable to constructively reform the regulator a genuine (though politically untenable) alternative would be to remove criminal penalties for intrusion and publication of private data provided that no physical damage was done and no disruption to daily operations occurred. Effectively legalizing blackmail of data breach and cryptominers.