Ok, so I was confusing the home depot hack mentioned in the article with the target hack, but I dont want to edit my comment after so much discussion. I also want to point out that i was trying to show an exception, not to say that noone should ever be held accountable for a breach.

In the target hack, hvac contractors had their credentials stolen, and malware was installed on their pos system. The home depot hack was malware suspected to have been installed on their self checkout machines[1].

So no, they never allowed anyone access to the unencrypted credit card numbers. Negligence is failure to exercise reasonable care.[2] Bad things happen, and even more so when sophisticated criminals are attacking you. It is impossible to create a fully hack proof system. I would say allowing a sql injection is negligence, but when people are using sohpisticated attacks, there is nothing you can do.

1. http://krebsonsecurity.com/2014/09/home-depot-56m-cards-impa...

2. https://en.wikipedia.org/wiki/Negligence