The last two were because Sony was storing personal data. This store made them a target.

Like the personal data they require when you sign up to PSN to play Helldivers 2.

If they don't collect data, they wouldn't be such a juicy target. So, yes, it is partly their own fault because they took the known risk of storing personal information.

They played with fire and got burned ... more than once.

Source: https://www.playstation.com/en-us/legal/privacy-policy/