They're not going after them for that. They're going after them for that plus an incredibly long list of other basic security failures, failing to notify customers that their personal data was now in the wild, and other negligence