Suppose you collect visitor data, and then leak it (accidental or otherwise), and users have their identity stolen and lose a lot of time/money dealing with the

Suppose you collect visitor data, and then leak it (accidental or otherwise), and users have their identity stolen and lose a lot of time/money dealing with the fallout. Would you agree that as a site owner who collected this data without securing it properly that you are morally obligated (and ought to be legally obligated) to fully compensate all the damage caused by the leak?