Blame is not a zero-sum game. Yes, the extortionist deserves all the blame you can heap on them. But that does not change the fact that Vastaamo were in charge

Blame is not a zero-sum game. Yes, the extortionist deserves all the blame you can heap on them. But that does not change the fact that Vastaamo were in charge of securing highly sensitive patient data and failed to do so.