Re: And as always
"I don't care if it was a third party that leaked, the data was entrusted to them."
Umm.
So if you use the same log-in credentials on Site A and Site B, and I manage to steal them from Site A and log-in to Site B with them, it's somehow Site B's fault?
You've just left a spare key somewhere, which I've got my hands on and used, and then you've blamed the house for allowing its front door to be opened with that spare key.