Not patching servers for months and leaving them for attackers to exploit is definitely stealing. It doesn't matter how they got the data, they let others steal it and were therefore complicit in the theft itself due to negligence, willful or not.
Yeah, they didn’t steal your data. They were negligent with storing data on you given to them by lenders, and if you can demonstrate you were actually damaged by their negligence you can join the class action that’s happening. You should have got an email about it. I know I did.