One manager, and their supervisor. Either the supervisor was negligent in doing their job, or supported the manager.

HR should probably be more on the ball too. And implemented policies/procedures.

There's never just one person who messes up. Kinda like how it's never just the Junior Dev's fault when they delete the production database.