Wow. What a shit company. It isn't the user's responsibility to secure the data that you store, it is 100% on you. If the user is reusing a pwd that might be the reason a single account got hacked but to beat a dead horse, you can mitigate that easily as a company.
Karma seems to always work things out.