Not only is this entirely speculative and needs a citation, just because others have experienced breaches doesn't mean you get to publicize private information, that once again, people did not consent to because they're not users or customers of Equifax.

>You don't know and the possible actual culprits did not tell you otherwise, so the responsibility lies with her?

Yes, that is the role of a Chief Information Security Officer. Here is a brief description for your reference:

>The CISO (chief information security officer) is a senior-level executive responsible for developing and implementing an information security program, which includes procedures and policies designed to protect enterprise communications, systems and assets from both internal and external threats.

Unless other information comes out to suggest otherwise, yes, it is very fair to assume the responsibility lies with her.