I don't want to detect from her crime, but the negligence of not having sufficient backups and not doing basic security (restricting access to data, disabling l

I don't want to detect from her crime, but the negligence of not having sufficient backups and not doing basic security (restricting access to data, disabling logins) should be addressed too.