It will depend on the jurisdiction (everything always depends on the jurisdiction), but in general a party will be liable if they deliberately leaked the information, or if they were negligent in allowing the information to leak.
You have three example cases here. (I use "they" and "you" below to refer to the employer and the employee.)
Firstly, they send the information to your gmail account, and gmail is hacked. In this case, the only possible negligence on your part, is giving them the gmail account rather than your work account as the destination address. It is very unlikely there is any case to answer under the NDA.
Secondly, they send the information to your gmail account, and your laptop has spyware. This rather depends on the operating procedures established by your employer. If the rule is that you may only access office information from a work-supplied machine, but you actually accessed it from your home PC, then this might count as negligence. Note that when I say "the rule", I don't just mean "that is what it says in the employees' handbook but everyone ignores it"; I mean "that is actually enforced by the employer". If you are allowed to access information from your home PC, then your employer would need to show you were negligent in allowing malware to be installed; that would probably be difficult.
Thirdly, you are socially engineered into revealing the information. This is the most tricky. It would depend on how aware you should have been that this information was likely to be under targeted attack.