When someone gets kidnapped there's no CEO that can go to jail for a privacy breach. Data breaches typically stay out of the news, if it becomes public the victim company can face legal action. It can literally be cheaper to quietly pay the hackers.