content: If you as a business owner take reasonablle measures to protect your customer data, e. g. employ security experts and programmers who know what they're doing, and you still get hacked, then yes, both you and your customers are victims. However, a lot of places have horrible security. If you as a business owner don't care about security, and your service does horrible things like storing passwords in plaintext in the database, then the only victims are your customers.