Comment by aaronmdjones

Cases like this usually boil down to one of three things:

1) Someone left an unpatched server exposed to the Internet for months with a known critical vulnerability.

2) Someone uploaded the data to a world-readable S3 bucket or similar, or left it in an Internet-accessible database server with no authentication.

3) Someone with administrative credentials was using the password "password1!" or similar with no two-factor authentication.

In an ideal world (not the world we live in), in these cases, that someone would be prosecuted for gross negligence.