It depends on where the breach happened. If it was on subway's end, yes, it's their responsibility. However if it happened on the end of whatever marketing firm this is, then it's the marketing firm's problem.
It depends on where the breach happened. If it was on subway's end, yes, it's their responsibility. However if it happened on the end of whatever marketing firm this is, then it's the marketing firm's problem.