Given that the care provider is the owner of this data, not the users themselves, I think they are also a victim. If we want to continue this analogy it might b

Given that the care provider is the owner of this data, not the users themselves, I think they are also a victim. If we want to continue this analogy it might be a victim that walked uninvited into a house with a big sign "you will be raped if you walk into my house", but is still a victim nevertheless. I do think that solely blaming the care provider for their failure to protect is incorrect because a non-victim can hardly file charges against the perpetrator. Of course, I agree that the care provider also did something wrong (as well as the hacker(s)) and that the people are also victims, but "the people vs. the care provider" is a separate matter from "the care provider vs. the criminal".