Speaking strictly in terms of laws being broken, the leaker would be responsible for both breaking into iCloud and for any legal privacy violations.
However, the logical trail of responsibility is longer, in order of precedence:
1. The leaker is foremost responsible for the leak
2. Apple is responsible for allowing the security breach
3. Lawrence is responsible for putting pictures on the internet of a sensitive nature
4. Lawrence is responsible for having the pictures taken
That being said, #4 is pretty inconsequential. I'm certainly not suggesting she shouldn't have had the pictures taken, but obviously they couldn't have been leaked if they'd never been taken... so in a logical paper trail, it must be mentioned for completeness sake.
#3 is what I'd scold her over. As I would scold anyone who puts anything on the internet they consider to be private. Even if Apple (or whatever other company) ensures your privacy, you shouldn't trust them. Obviously they can't guarantee with absolute certainty that what they store will remain private. No internet company can. If their machines are on the net, the possibility exists that hackers can make it through. Or the tl;dr version: assume anything you upload or post will be seen by the world. Never trust the middlemen. This is also true when talking on the phone and texting.