Um. It doesn't matter how the attackers get your user's data - if they get it by compromising a third party, that means you had already given a third party full and unencrypted access to your user's data. I would bet anyone "agreeing" to let you share data with other companies assumed you were doing the standard "we help ad companies spy on you" BS, and not "all our data security claims are BS because we're providing full access to all your data to completely unrelated companies"