Well obviously the blame is with BA, but characterising it as the fault of a lack of infrastructure investment is plain wrongheaded given what we know.

Without getting into the politics of victim blaming, it is possible to be both victim and to share some responsibility. Say you are burgled and someone takes a computer with emails with details of someone else's travel? Would you expected to be sued by them for punitive damages? Now that's not a directly applicable analogy to a business process lapse of this scale, but it shows it's not as simple as black v white.

i think BA will be hammered by the regulator on this by the way, as T1 says, they're responsible for poor practices and process from what we can see. They won't come out and say that. They won't make gestures that imply that. The time for that is later.