When the first public data breach occurred in 2005, there was little to no legal oversight in place. In response to data breaches, the threat actors typically garnered the exclusive responsibility. As the law has evolved and data security incidents have become more common, public and regulatory sentiment has shifted from blaming the threat actor toward holding the victim company accountable based on its purportedly deficient cybersecurity program.