It doesn't affect stock price because it doesn't really affect the money being made. There aren't going to be any huge fines that need to be paid, they aren't really going to lose customers explicitly due to this. After all, it was _hackers_ that broke in and did bad things, you can't completely protect yourself from hackers. If the difference between having a secure company and an insecure company were cut and dry, then it might have an affect. But the entire security landscape is so nuanced and complicated that the average person watching/reading the news isn't going to know the difference between 2 different companies (one with good security practices and one without).
I wonder whether a marketing campaign focused on security would be effective. For example, "We are the only accounting software to use end-to-end encryption of your financial data. Don't trust your sensitive data with anyone else!"
