Agreed that you are not personally responsible for this particular attack, though I see it as the latest in a series of cascading failures, beginning with the initial attack. It's the lack of consideration of security - that can only be baked in from the outset - that's the real root cause.

If the application had been self-hosted in a physically secured location, the attack that exposed the LastPass credentials would not have happened (email reset of root passwords). It may not be cool, but the cloud/consumer-level hosting is not appropriate for applications handling large sums of money.