The Police have a duty to prosecute Newsweek.com.
If I go to McDonalds and it turns out their supplier's supplier that was at fault for the glass in my burger then it's McDonalds that would be the ones paying me (before) court.
Likewise if my personal details were passed to fraudsters because the subcontractor's outsourced data center of the insurance company that my bank use to underwrite an insurance policy was dodgy, then it would the bank that was at fault.
Where a crime has affected many people by a small amount - in other words it's not reasonable for a single individual to press charges - then I believe the Police have a duty to act.
If no action is taken then it's a signal to businesses dependant on ad revenue that they do not need to take reasonable care to check their adverts, or at the very least ensure they have procedures and policies which are appropriate for the agencies that they use to supply ads.