Yes, always blame the companies who steal and sell your information and have crap security.

It was always hard to point the finger. Basically the problem stems from the idea that for breaches there just are no significant repercussions for the parties involved. They pay for (or set up) some form of credit monitoring and then just go on about their merry way. In the event that they are held accountable at all it's usually something like a fine, which to the vast majority of these companies is less than a slap on the wrist. These corps consider it the price of doing business.

As someone who's data has been exploited (and who's data was actually leaked by breaching the federal government), I'm gonna say there's just not a lot to be done except doing your due diligence to change the PII you can change (locking your credit, monitoring credit reports, changing PII like your SSN or other ID number etc).

But I doubt even a class action suit would do much in most of these cases.