Vendor "fined" by customer for lax security that resulted in an incident

Richard Bejtlich reports on a story that appeared in the Washington Times last week, "Apptis Inc., a military information technology provider, repaid $1.3 million of a $5.4 million Pentagon contract after investigators said the company provided inadequate computer security and a subcontractors system was hacked from an Internet address in China..."

As Richard said, this may be a first. When is this going to happen in the commercial market?