While the individuals themselves may be thought of as users, they are employees of 3rd party partners who act as data handlers and/or data processors. As such

While the individuals themselves may be thought of as users, they are employees of 3rd party partners who act as data handlers and/or data processors. As such it is entirely appropriate that the platform is responsible for this compromise (although depending on the terms of the contract, they could seek restitution from the 3rd parties. If you as a consumer give your booking.com login information to someone and your information is subsequently stolen, Booking.com would not be responsible for your security practices.