But if you attest that your computer system is not accessible by any passersby in order to pass compliance, is that not also a crime? If it is indeed accessible to just anyone? HIPAA law violations and all that

I’m not arguing the person who stole didn’t commit a crime - just a lesser one than actually breaking in, cracking a safe, and making off with the jewels. I think the CEO and executive staff are culpable.