In some ways. We could have a philosophical argument about fault and victims, or we can just agree that it’s happening and as long as it is, the victim needs to do something to protect themselves. The world sucks sometimes, and breaches are part of that suck. So, while the criminal h4c|<7r is always at fault for attacking, the victim is never at fault for being a victim. But there’s an exception: when property, including money, data, identifying info, etc. of the company’s customers and employees gets stolen, then those people are the actual victims, and the company is now sharing part of the guilt for not safeguarding that property. It’s at least like a drunk driving accident, where the driver is both guilty for dangerously poor judgment and is a victim at the same time. Unless another car is involved, in which case more charges are levied on the driver for the other crimes committed due to that poor judgment, and the other car’s occupants are the true victims. Unfortunately, too often customer data loss from a breach is at most a breach of contract to properly protect client or employee property, but in reality should it also include some form of criminal collusion or maybe aiding and abetting with the criminal? And you know why it’s not? Mainly because it would chill innovation and modernization, which both have at the least some major economic repercussions. And if it was criminal, then many companies wouldn’t report it to avoid incriminating themselves, which is worse for the real victims, customers and employees because they may never know they’ve been robbed and can’t take steps to counter further problems or even demand remuneration from the company. So, it seems the current reality is yes, the company is at fault, but if they follow the proper fessing-up to their mistakes, they can avoid penalties and taking blame, which is the whole point of finding out who is at fault. Hackers just suck.