In their TOS and Privacy Policy it’s made clear they are also data controllers. Unless you contribute to the breach it would almost certainly fall on them.