- (unquestionable) the attackers but as well as

- the IT-department that did not fix serious vulnerabilities (of an apparently mission critical system)

We have that in all kinds of places: If you neglect your duties on maintenance or diligence in areas where humans could be harmed (electrical installations, fire safety, construction, whatsoever), you are liable for whatever happens. I don't see why IT should be somewhat special. The Citrix patch came out half a year(?) in advance.