Not the GP but that's clearly the case IMO. If I share my tax records with my accountant and their office is broken into because they left the office key sonewh

Not the GP but that's clearly the case IMO. If I share my tax records with my accountant and their office is broken into because they left the office key sonewhere, do I blame the office building or the accountant? We can argue about whether the office building should have had better security and noticed weird people around, but ultimately it's the accountant's negligence that allowed my info to be compromised, and if I suspected they weren't the best with their security, I should have factored that into who I decided to share my info with.