Oh, here's a case from the past that was still in the courts.
Does everyone remember the Court Ventures /InfoSearch/Experian cases and finger-pointing? The cases involved a bad actor using a contract with one entity to access the files of another and to sell access to other bad actors with lots of #IDtheft resulting. And then Experian bought Court Ventures and shortly thereafter, the Secret Service contacted them and told them that there was a problem...
Both DataBreaches.net and @briankrebs had covered the cases quite a bit back in the day if you search our sites for more background, but basically, Experian was suing Court Ventures to indemnify them and suing InfoSearch, claiming they should be notifying consumers, not Experian.
In the meantime, the criminal, Hieu Minh Ngo (aka Jason Low) was sentenced to 13 years in 2015. He was given early release in 2020, so he's already out while all the lawsuits about the breach go on. Ngo was recruited by Vietnam's National Cyber Security Centre (NCSC) as a technical expert.
In this newest judicial development, a California appellate court held that Court Ventures had no obligation to notify consumers of the breach under California law, because even though Court Ventures did own the data while the data were being breached, they did NOT own the data on the date of discovery of the breach.
See:
https://news.bloomberglaw.com/litigation/company-bought-by-experian-neednt-report-pre-sale-data-breach
Direct link to court opinion: https://www.bloomberglaw.com/public/desktop/document/ThePeopleofTheStateofCaliforniavsCourtVenturesIncetalDocketNoG061?doc_id=X26B5VQVF4I8G1Q7TLPN1NR7F8I