It's their responsibility to immediately stop the source of the leak, and then figure out or hire somebody to figure out how it happens and fix it, not the credit card company. Again the issue is not the breach itself, it's how they handled it.
They were made aware of it by Visa after about a week. They should have immediately stopped taking credit card payments and notified their customers. They didn't stop doing that for months afterwards and tried to take advantage of the panic buying. They only apologized after they were called out on it, and basically admitted that they acted unethically.
Breaches happen, and get fixed. It's the reality nowadays. But their reaction to it and in the aftermath of it getting exposed is completely opposite of what a business should do.
...and to add insult to injury, they haven't made any comments since. They are praying the memory of this dies on the vine.