Given the indemnity clause of a website's ToS below, am I correct in my non-legal opinion that if someone hacks my account, even if due to the sites lack of security, and causes harm or loss, I'm financially on the hook for it? Is that enforceable?

My location is Florida, but the company has offices at least five US states including California and North Carolina

{Emphasis mine}

  1. INDEMNITY. You agree to indemnify and hold harmless , its owners, affiliates, officers, directors, employees, consultants, licensors, agents, and representatives from any and all third party claims, losses, liability, damages, and/or costs (including reasonable attorneys’ fees and costs) arising from your violation of these Terms, or your infringement, or infringement by any other user under your name or account (whether or not authorized or known to you), of any intellectual property or other right of any person or entity. We will notify you promptly of any such claim, loss, liability, or demand, and in addition to your foregoing obligations, you agree to provide us with reasonable assistance, at your expense, in defending any such claim, loss, liability, damage, or cost.

2 Answers 2


Contracts are fundamentally about risk allocation

For example, when you engage a contractor to perform work for you on a lump sum basis, they are taking the risk on cost. If you engage them on a cost-plus basis, you are taking the risk on cost.

In this clause you are agreeing to indemnify the operators against third-party claims associated with your account howsoever caused. At face value there is nothing fundamentally wrong with that risk allocation.

However, at common law a contract term may be declared void if it is unconscionable at the time the contract was made. This clause is not obviously unconscionable.

In addition, some jurisdictions prohibit unfair contract terms in consumer contracts. Unlike unconscionably, unfairness is usually determined based on the effect of the term in practice. This term may be unfair.

Note that losses caused by deliberate acts, fraud or crimes of the beneficiary are not protected by an indemnity. However, you are indemnifying them for their own negligence, however, some jurisdictions have legislation that imposes proportionate liability that may override indemnity clauses.


Is that enforceable?

Yes. The abusive clause is enforceable if you consent to it. I am not aware of case law that strikes that type of clauses.

By consenting to that clause, you would basically provide hacking & litigation insurance to the company for a premium of zero dollars. That is precisely the reason why I declined signing for automated payments to my landlord: the clause is very explicit on who would cover all losses & costs in the event that the landlord's systems are hacked.

  • Unconscionable contracts are not always enforceable, and a court could void the contract if it found it abusive. Just because you consent to it, doesn't mean it is universally enforceable, especially if the drafting party takes advantage of the lack of knowledge or resources of the other party for its own gain.
    – Ron Beyer
    Jan 7, 2019 at 16:24
  • @RonBeyer Right, but here (1) the clause explicitly encompasses the lack of knowledge (see language in bold: "whether or not [...] known to you"); and (2) the clause is about covering losses, which is different than company's actual pursuit of profit. Shifting losses is not the same as seeking gain. Jan 7, 2019 at 16:45
  • 1
    There's also the difference between winning a lawsuit and not having to be in one in the first place. Even if I knew I could win such a lawsuit, I'd rather not invite it. Jan 7, 2019 at 17:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .