Apache Struts Statement on Equifax Security Breach

How would this handle APTs? There's going to be some way in with enough poking pretty much all the time. Should there be insurance? Bailouts with the government going after the culprits (criminal investigation or sanctions for foreign government interference)? I do want there to be fines and such, but they need to be something that companies can actually survive. Percentage of revenue made from the data or in total maybe?