If we extend your logic, the victims aren't the customers whose data has been lost. The victim is the common good of not having to be all that careful about wh

If we extend your logic, the victims aren't the customers whose data has been lost. The victim is the common good of not having to be all that careful about what you do, because you live under the rule of law and people aren't just going to attack you. Allow me to illustrate. It's not physically difficult to get murdered, but you don't have to walk around in a suit of armor or tank in 2015, because you live under a code of laws. So safety/security is a public good. By the logic that the operator of the servers that have been illegally attacked aren't the victims, we can say that public safety is the real victim: people who aren't even involved are the real victims, because there are more of them, and they all have to be more careful as a result. But that reasoning is kind of silly. The victim of the crime is the operator of the server that was illegally accessed and compromised, and if these criminals had something better and more productive to do with their time it wouldn't happen. It's up to laws to make that be the status quo. It's great when technology can protect us - but let's admit it, it's like going shopping in a tank: a technological solution to a social problem. You can't always do it. (Technological solutions don't always exist.)