IMO, any financial institution, credit reporting agency, or merchant who comes into possession of peoples' information should be held strictly accountable and responsible for keeping it secure regardless of the circumstances that put that information in their hands. When someone hacks into Trans-Union's database and hoists consumers' financial data a simple "oops," apology, and a year's worth of "free credit monitoring" do not cut it.
