Yes.

The data they stored and ‘secured’ wasn’t theirs and so they cut corners and left vulnerabilities because what was at stake didn’t affect their profit margins.

I’m sure they had some fineprint saying otherwise, but outside of a courtroom it is easy to see who did what and why.