One way to do so would be to make it so wireless companies can lose access to spectrum as a consequence of customer data breaches. Let someone else who can keep customer data secure have it instead.
Most countries only have three large mobile carriers. You can't take action against their actual operations because you would be running out of alternatives pretty soon plus you would cause huge disruption to customers.
I think financial penalties are still the best bet if they are large enough to really hit profitability but not large enough to kill the company.
That ultimately hurts customers more than the data breach. Limiting access means less availability for customers. If all the customers leave, you’ve just contributed to a monopoly/oligopoly.
Or reserve it for the next company that could pony up at a significant discount.
Look - too big to fail means we let too many companies merge. This isn't a healthy situation that losing T-Mobile means having no competition left. We should probably unwind some mergers first.
I think financial penalties are still the best bet if they are large enough to really hit profitability but not large enough to kill the company.