Yeah, no, I have a bit of a problem with this. There is a lot of stuff coming out of this hack that should never, ever have been on corporate IT systems in the first place. Stuff that doesn't come out of regular HR data where people should have a reasonably expectation of privacy and security, but stuff people have put there themselves.
And I don't think this should ever be considered normal behavior, to use corporate IT systems to store such private data.
Yes, these people are victims, but I think it sends the wrong message to say that their own role in this was completely normal behavior. It should be possible to be critical of this without drifting into blaming the victim territory, and I'm kind of missing that from the whole Sony hack discussion.