In the even of a data breach I believe there are two parties who are ethically responsible, the hacker and the company/entity that was breached. The hacker is ethically responsible because the hack is a morally irresponsible thing o do and often done for self serving reasons. Their actions ultimately affect multiple people involved with the incident negatively. The company/entity is also responsible for leaving their customers data improperly protected.