Punishment

They should be fined and sent to jail. They should be financially responsible for the economic damage that they inflict, and jail at least for 10 to 20 years.

If they cause a major distruption to government, or military computers they should be charged with causing great harm to the security of the country and that perhaps looking at some sort of treason, crime against the state should be studied.

Until the punishment fits the crime it will continue to happen.
Take everything they have and put them in jail and throw away the key.