Most jurisdictions have laws around wilful negligence endangering safety. For example in New Jersey (literally just picked the first one but they're all about the same) https://lawnj.net/faqs/what-is-willful-negligence-in-injury-...

"New Jersey Administrative Code § 17:3-6.5 defines willful negligence as:

Deliberate act or deliberate failure to act; or Such conduct as evidences reckless indifference to safety..."

Now obviously that link refers specifically to injury compensation, but it's pretty easy to see how you would make a case that the actions of these companies constitutes reckless indifference to safety, whether or not they actually intended hacking to occur.