Just to be clear, corporations and executives do not get qualified immunity. They just get to pay with someone else's money (insurance, or shareholders) instead of their own.
I don't know why judges don't insist on jail time for someone in these situations. It might not make sense for a mistake that happened once, but after they knew it was happening and didn't fix their systems, the behavior was knowingly reckless.
Should be on the CEO's head unless they can prove it was someone's malicious action without their knowledge. At least that would partially exclude the ridiculous compensation