I think the key here is that person A used admin access to a product to access user B information and then made it public. I would say that the company that own

I think the key here is that person A used admin access to a product to access user B information and then made it public. I would say that the company that owns the product should also be sued since I am pretty sure this data usage is not covered in their privacy policy/TOS.