The real victims are the people the data is about, not the entity improperly storing the data. The entity that stored the data is to some small extent a victim

The real victims are the people the data is about, not the entity improperly storing the data. The entity that stored the data is to some small extent a victim, but most importantly they are a perpetrator.