"“We are aware that Equifax was the victim of a criminal cyber attack in May 2017," the NCSC said in a statement today."
No. They're not the victim. They dropped the ball, and they've obviously been dicking about for years with the way they have handled data that, in all fairness, doesn't belong to them.
The 15.2 million people who have had their details stolen, they're the victims.