Legally speaking, a corporation is one of the best "liability shields" you can have. It is its own entity that is, for most purposes, the entity that the rest of the world is interacting with when they interact with anyone empowered to represent it and make decisions on its behalf. It, and not its agents, bears the full brunt of any legal liability for damages caused by actions or inactions of the company or its agents.
As such, you're probably not going to convince the executive team, or the board of directors, or even middle management that they would bear any general liability for a breach of security. To do this, you would have to prove specific intent to harm; that an executive saw a name on a list of customers, didn't like that person or company, and wanted to hurt them, which in turn led to their deliberate decision not to fix a known security flaw. This is next to impossible; you can show all the evidence you want, but even if you have a recording of the CEO saying they wanted to harm this person's interests, you cannot prove that a CEO's decision to fix or not fix a flaw was motivated by this; it's all circumstantial (though a recording would go a pretty long way towards "preponderance of evidence").
There are, however, some instances where specific people can be held liable independently from the company. My wife, for instance, works with healthcare records. If she ever told anyone, even me, any specifics of that data, and that became public, it's her tail on the line for the HIPAA violation, even if her boss told her it was OK or even ordered her to divulge the information. I work for an alarm monitoring company; our alarm center agents, if they make the wrong mistake (even in good faith), can be held liable independently from the company for damages and wrongful death. Unfortunately, it happens. But, this liability does not extend to anyone who was not aware of the events at the time, so you're going to have a very hard time proving that an action by an agent on the lowest rung of the corporate ladder implicates the CEO.
Where you can hurt an executive is where it matters most; their wallet. Executives typically own a significant stake in their own companies, which forms a relatively large chunk of their net worth. The company is their shield, but it's also their livelihood, and it will take a beating if a security flaw in their systems is found, exploited, and subsequently makes it into the press. Corporations cannot go to jail, but they can be fined and sued to "death", and the executives lose all the money they had in corporate stocks and options.
Want proof that companies have gone bankrupt over security breaches? DigiNotar, a Dutch company that was a globally-trusted SSL/TLS certificate authority, was hacked in July 2011 and apparently again in late August of that year. Several fraudulent certificates were created using DigiNotar's systems, identifying the certificate holder as being the valid domain of major sites like Google, Yahoo, Mozilla, WordPress and the TOR Project. Those certificates were subsequently used in MITM attacks and other hilarity. DigiNotar did not know how many certificates were issued (the tally quickly reached the hundreds; we now know that 531 fraudulent certificates were created in this attack) and so could not guarantee they had all been revoked. So, Microsoft and most of the major browser manufacturers responded by simply revoking trust in DigiNotar's own trusted root certificate in the Windows OS and major browsers. Apple's response was delayed, but it did also update OSX/Safari to revoke DigiNotar's root certificate.
In addition, DigiNotar was responsible for one of the intermediate CAs used in the security system of the Dutch Government. That certificate was also believed to be compromised and was revoked by many browser manufacturers, and in the ensuing hilarity of real government websites losing trust (imagine browsing to the IRS website and being told by your browser that the site may be fraudulent; THAT's a screenshot I'd pay money for, and it happened to the Dutch counterpart Tax and Customs Administration), the Dutch Government stepped in on September 3, took control of DigiNotar's certificate operations, transitioned all government websites off of DigiNotar-rooted certificates to ones signed by uncompromised CAs, and issued a statement saying that DigiNotar would no longer issue government SSL certificates. DigiNotar filed for bankruptcy the same day.