Not necessarily. They could make an argument that the services themselves were not "breached", however the users weak passwords allowed them to be compromised.