That’s not an excuse. They chose to operate an online service, one that collects personal information. That entails the responsibility to secure it. If they can’t do that, they shouldn’t have offered the service.
Sort of a "she was asking for it" kind of situation, I take it?
Or alternatively we could hold criminals responsible and return to a high trust society where you can provide public services without having your own military department.
You are aware that personal information is routinely stored in places that you can break into with a literal brick to smash a window? Somehow its only computers where people turn off their brains and argue that proactive measures need to be 100% effective at blocking all attacks no matter how high the cost.
Can any online service guarantee security?