Some blame can be placed up-front, at least potentially. Regardless of the _nature_ of the breach, if the data ought not to have been stored, the fault lies with those who decided to store it.