Let's presume this is a company, who would you say should take the fall for this?

The CEO will have to talk about it and manage the fallout. What else are you looking for.

Also, at this point we have no idea how they got in, until we know I think we should withhold judgement. Unless you consider yourself responsible if someone ever gets into a system you manage with a zero day.

Security is not an exact science, it's a trade-off between sensitivity of the data and the cost of protecting it whether you like it or not

Punishment isn't an exact science either, and there will be some arbitrary decisions that will be taken in order to find a trade-off between visibility and responsibility, whether you like it or not