The difference between this situation is that you still committed an action, compared to simply being acted on. A better analogy would be like if you were a ba

The difference between this situation is that you still committed an action, compared to simply being acted on. A better analogy would be like if you were a bank holding peoples' money. Armed assailants break into the money and take it. Is the bank liable because it did not have adequate defenses for the attack? But the bank situation is easy to solve because it's money and money is fungible, so you solve it with insurance. Leaked data can't be revoked and it's hard to quantify. If you make the policy wrong, you essentially end up punishing a victim party (the end users are victims, but the firm that was attacked is also a victim).