The word 'house' is doing a lot of illicit work in your metaphor. A better analogy would be if a bunch of families had decided to install CCTV cameras, then got

The word 'house' is doing a lot of illicit work in your metaphor. A better analogy would be if a bunch of families had decided to install CCTV cameras, then got their neighbor Garry to watch them. Unbeknownst to them, Garry was storing the tapes a lot longer than anybody imagined, was pointing the cameras so they looked into people's bedrooms, and he was selling some metadata to third parties, and he also kept the key to his house in a plant pot by the door. Some teenagers messing around, find the key, and have a look around. Suddenly, it's the teenager, not Garry, who's the problem here. That's how data breaches work at the moment. And because it's Garry's 'house', we all think of the company as the victim.