It depends on the nature of the breach. If the information for example was stored under non-adequate circumstances, the company could be held responsible for the data loss deriving from the breach.