Legally liable parties for a data breach are anybody that was negligent in how they handled your data.
For instance, if you go to a hospital, and they do an intake, and you give them information, and then they turn around and give it to their IT vendor, and their IT vendor was breached, even though the hospital would claim they did nothing wrong, they were negligent because they gave it to a party that was negligent. Their responsibility is to make sure that they hire companies that are not going to.
