Naming and shaming the company and the extent of their security failing is enough. But only after they have patched the hole.
The customer has to suffer from the mistakes of the companies so that:
1. She stops trusting any company blindly with her data.
2. The market demands improvements from the service providers (and no, sacrificing a scapegoat in court is not an "improvement").
3. Service companies react. Unless there's a major scandal, companies are slow to react to vulnerabilities.
About that last point, it's a bit unfair to assume that the activist tried to contact AT&T and they didn't react. I honestly don't know if that's what happened in this case, and I hope it is. However there are several cases of companies "turning a blind eye" on the issue.
As a customer, the only entity to blame when such a breach occur, is the provider that you entrusted with your data. Not the activists (regardless of their intents) nor the hackers or whatever monster you heard about in the media.
If I entrust (and pay) someone with my bike and it gets stolen on his watch, who's to blame? The thief or the guardian?
Because life is pain?
But of course you can always sue the company that leaked your data and then mistreated people who warned them. Hell, you should. Probably with a class action suit.
lol... just a touch dramatic there.
So we will come up with whatever justifications needed to say it's okay.