&gt;<i>The bank is at fault because the bank has a responsibility to ensure the security of their operation</i><p>Yes, and in the case of the Tribune company here, it cost them tens of thousands of dollars to &quot;repair&quot; the breach.  That&#x27;s the punishment for their failing of responsibility.  It&#x27;s not like they are suing to recover that money.<p>But I&#x27;m not sure how that absolves the <i>actual</i> criminal here.