Comment by selcuka

Sure, it is their responsibility, but that doesn't answer the question "Does it matter whether the data was poorly secured?"

If your house is robbed, does it matter whether you didn't have a state-of-the-art lock? A robbery is still a robbery.