They have to investigate and also apologize accordingly in the name of the university.

Saying the researcher is the only responsible of a work that is managed by the university (with things such as probably funds and for sure resources) is just wrong.