The biggest problem is that Avid Life Media has done jack squat in response to the data leak. They've not communicated any kind of risk mitigation strategy. They've not allowed users to change their compromised passwords. They've not made any efforts to contact affected users.

This is like a rape victim not only trying to pretend the whole thing didn't happen, but all the while knowing that her attacker had HIV, has good reason to believe she's seroconverted, and is still having unprotected sex with her regular partners without telling them anything.

While the company is a victim here, their actions are themselves criminally wrong.