Not really. The victim here is the people whose information has been distributed, not the system (and the people running it) the information was exfiltrated from.

If we are going to use an SA analogy, this is closer to the recent case of a hotel chain where there were several instances of staff giving “randoms” keys to rooms that they should not have. Best practise procedures were not being followed, the ne'er-do-wells took advantage of this, someone else suffered as a result.