Is that an accepted norm if there is no fault? Let's say Home Depot did everything right, and through no fault of its own someone managed to break in and take its data. However, in this case, it seems to be that there is blame to be put on the shoulders of Equifax. It was informed to do something and chose not to do it, so there is a fault there.
Is that the norm whether there's fault or no fault?