How long before owning a breach databases requires a license in order to avoid a criminal charge? I have to imagine that access to breach info from other source

How long before owning a breach databases requires a license in order to avoid a criminal charge? I have to imagine that access to breach info from other sources greatly reduces the work necessary to pull off another breach as users typically use the same "highly secure password" across most, if not all of their online and work accounts. All you need is one breach with weak password hashing -- or no hashing or encryption -- to provide an electronic skeleton key to intruders. The more breaches that occur, I think the more we'll see. Just curious: if a prior breach, for example the Equifax breach, yields data that enables a future breach like Capital One's, can Equifax be held liable for damage to Capital One?