Of course it's a criminal matter! When a bank is negligent and leaves the doors unlocked, they're on the hook for massive civil liability if people's deposit boxes are robbed. The thief is still going to jail if caught, though.