Yes. Their platform, their security. Their failure to secure their users data is solely their fault. Notice that other platforms don't have this issue. You'd think after the first one, they'd fucking pony up and take security seriously. Sony didn't learn anything.

If it was just one event, I'd advocate for leniency. But Sony doesn't get that from me.

The last two were because Sony was storing personal data. This store made them a target.

Like the personal data they require when you sign up to PSN to play Helldivers 2.

If they don't collect data, they wouldn't be such a juicy target. So, yes, it is partly their own fault because they took the known risk of storing personal information.

They played with fire and got burned ... more than once.

Source: https://www.playstation.com/en-us/legal/privacy-policy/