It would depend on how the breach occurred. I do believe that sometimes businesses are not aware of it, or may not have been the cause of it.
Imposing a $100,000 penalty on a small business--versus a large bank--would put them out of business. When you talk about levels of breaches, and the impacts on the business community, I think you have to be very careful when you start going down that road.