[excalibur]

This is a fair point. Many of these large data breaches are revealed to be the result of negligence on the company's part (and often the company faces few to no consequences beyond public shaming). But in this particular case we simply don't have enough information yet to make that type of claim.