They used md5 as a password hash with no salt. The only ones that deserve jail time is those developers.
(Granted, that doesn't dispute the fact that the actor is still deserving of a lot of that liability. :) )
Better analogy- if I put some items up for sale in a consignment shop, and the shop owner doesn't lock the door overnight and someone runs off with all my stuff, I'm likely to be more upset with the shop owner than the actual thief.
But anyway, I wasn't talking about who's liable, I was simply stating the fact that those developers were criminally negligent.