In the sense of "Simpsons did it!":
Equifax did it first.
Sure wish the massive corporate incompetence and malfeasance causing huge data leaks multiple times over the years would get mentioned every time one of these stories comes up.
Hackers did blah, this WOULD ALMOST matter, but!
We need to start redirecting some of those board bonuses and CEO dollars back into infrastructure to actually secure this shit as a required responsibility and stop places from being allowed to request personal information they shouldn't have.
I can't tell if he's being sarcastic or not.