I believe Amazon and Apple did not perform due care and due diligence. The only information that Apple required, that was close to being private was the last four of a credit card. Amazon really should have required more private information. It sounds like the Apple employee also did not follow policy. Apple can be quoted from the article admitting that employee failed to follow guidelines and they are reviewing their policies. Companies can be held liable for employee actions. Amazon had a weak security policy as well. There really is no point in asking