$1m in restitution to 132,000 people. Ter-fucking-riffic, roughly $0.8 per person and with handling charges will mean a final payment each of probably under 1 cent.
Seize all his assets and make a significant payment to the victims - enough for life long credit monitoring or sufficient funds to get new credentials. One year of monitoring is completely inadequate, it assumes that the criminals are not smart enough to sit on the data for a year or so.