There is no moral difference between blaming a woman for having her pics stolen, or for being raped.

[mythology]

104. Do you lock your doors?

Taking basic safety precautions isn't blaming the victim. It's taking steps to avoid being a victim. I don't leave my car or house unlocked. Why? Because while I can't stop every thief, I can take steps to deter the ones looking for the easiest targets.

Putting something online that isn't already encrypted is running a risk. Obviously not everybody knows that. But we have reached a time where everybody should. All of the cloud services that are designed for ease of use like iCloud, like Dropbox aren't as safe as other options. The easier it is to retrieve something the less secure it is.

Likewise Apple should have known to implement a password attempt limit because that's even more basic internet security and Apple is a software company.

And of course the hacker(s) is(are) wrong for stealing the data.

Personally I would assign most of the blame to the hacker(s) as they committed an actively unethical act. Then to Apple for implementing bad security.

And yes I would say that the people who were hacked didn't use the best online security protocols. Did they deserve it? Obviously not. But they probably could have taken some steps to not be as vulnerable as well.

There is a world of difference between saying they deserved it and they could have prevented it. I could have prevented my debit card from being caught in the Target breach by only paying in cash. But that risk is weighed, consciously or not, against the ease of paying via the debit card and risk of carrying more cash.