No, twitter is the perpetrator here, by having woefully inadequate systems. The kid is the victim, of his own hubris, and of twitter freely leaking customer information to anyone who asks for it.

I used to be CTO of an ecommerce platform - small fry, barely £1bn in annual transactions - but it was always absolutely clear in my mind that any breach would be my fault through negligence.