Blames itself? Well, sort of...

...but you had to read between the lines.

They refer to "A vulnerability within our implementation of Webmail", but, IMHO, this is hardly the most direct way of putting it.