[adameasterling]

I don’t know about criminal liability, but they’re certainly at fault for not implementing a check against known compromised passwords[1]. I believe it’s been an accepted best practice since something like 2017.

1. https://haveibeenpwned.com/Passwords