Been thinking about this for a while: Suppose a company is hacked and maybe a lot of customer sensitive or financial data is stolen by the hackers. Who is legally liable for any damages?

  • Is it the Company itself,

  • The software developers in case they had some sort of security software they where using and it did not play its role,

  • Or the customers for not being careful with their private information.
  • what country? Did the company agree to the terms of the software (eg a EULA - End-User License Agreement) which generally claim the software provider is not liable for anything?
    – Duncan
    Commented May 25, 2017 at 18:47

1 Answer 1


Being liable ("subject to liability") has to do with A's ability to seek compensation from B for a wrong that B has done that harmed A. A customer cannot be liable for damage done to himself, though he may well be responsible. The company might be liable to the customer. In turn, the software developers might be liable to the company, or to the customer, if the developers were negligent. If the customers were somewhat responsible, that (contributory negligence) could reduce the liability of the company or the developers, though for what you describe it's hard to see how there could realistically be contributory negligence on the part of numerous customers. Depends on what you mean by "is hacked" – usually, if an idiot uses "password" as his password, we don't say the company was hacked. Customers don't have information that they can negligently expose that leads to hacking of a company database.

And of course, lest we forget, the miscreants who steal the data are also legally liable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .