Victim blaming isn't right. Yes, they could have exhibited more caution. No, it's not their fault.
But this case is more like you sticking your fingers into an electrical socket, after being warned continuously not to do that, and then crying that it was the utility company's fault for putting something dangerous in your face.
We've been told since the advent of the internet to not share personal information online. If you want to take the risk, you have to accept the consequences. However, in this case the story is even worse as the intent of these people was to violate that rule not just for themselves but for other people as well.
So if you upload your id to a flash in the pan website, who's fault is it when the rookie website turns out to have expectedly low security?