Can an employee be sued?
Option A: An organization does not have password policy.
Option B: An organization has a policy but does not enforce it
It would be up to the jury (or judge in a bench trial) to decide based upon the facts in that particular case following an evidentiary trial on the merits. There is no black and white rule of law to resolve the issue in the abstract.
First of all, anyone can be sued by anyone with writing materials and money to pay the filing fee. What people usually mean when they say "can X be sued?", however, is whether there is a valid legal basis for imposing civil liability under the circumstances in a lawsuit against X.
To answer the latter question, the first question that needs to be considered is would be who is suing the employee.
Third-Party Victim Lawsuits
Is it a third-party harmed by the inadequate password policy or the employer?
A third-party could hold both the employee and the company liable for even simple negligence absent a contractual waiver of liability by the third-party, assuming that the third-party were able to learn which employee was at fault. In many cases, however, there would be a contractual waiver of liability, in which case gross negligence would have to be shown (whether or not the waiver purported to waive liability beyond mere simple negligence).
The determination of whether the conduct amounts to negligence, gross negligence or was not negligent would ordinarily be a question of fact to be decided after an evidentiary trial on the merits, for the jury (or in a bench trial, the judge), and not a question that could be resolved as a matter of law prior to trial or on appeal.
The negligence of the employee would be evaluated by the fact finder at trial in the context of a reasonable person in the employee's shoes, while the employer's liability would be broader because it would include the question of whether it was negligent for failing to put a policy in place, or otherwise take measures to insure better security.
I could see this fact pattern going either way, both on the issue of employee liability and on the issue of company liability. It would come down to the jury's sense of what was reasonable, the expert testimony on what was reasonable, and the testimony of the lay witnesses involved in the case.
The legal standard for negligence under what is known as the "Learned Hand test" after the judge who devised it, is that conduct is negligent if the foreseeable harm of not taking a precaution times the likelihood of that harm occurring if the precaution is not taken, exceeds the cost of taking the precaution. (Gross negligence requires that this standard to be met and also for the risk to be such that it is serious, blatant and obvious to any reasonable person even if it wasn't subjectively evaluated in that manner by the person being sued.)
So, while the test of negligence is basically "objective" the facts presented would need to show how foreseeable the harm would have been, and how likely a reasonable person would have believed it to be that the failure to take a precaution would result in a harm of the kind that occurred that was significant.
For example, failure to use care in setting a password that allows someone else to pay a third-party's utility bill might not be serious enough to rise to negligence let alone gross negligence unless that person also had any reason to foresee that it would allow a hacker to hack the third-party's bank account information and clean out their bank accounts.
In the same vein, the case for liability would be stronger if someone clearly warned the company and the employee of the risks and laid out the likely consequences of not doing so, and then that happened, especially if the person providing the warning and the victim of the lack of security were the same person.
(There are some fine questions of legal theory and case law go into issues like if there is negligence liability to fail to take a precaution when the dominant concern of a reasonable person, such as an intentional hack to steal financial account information, doesn't occur, but some far less probable risk, like an accidental deletion of critical files by a baby or cat left unattended at the keyboard, does occur and causes a much less likely but foreseeable harm.)
The existence of a policy would help on the issue of liability, but would not be a complete defense. Having a policy and not enforcing it could conceivably be worse than not having a policy at all, as it would show an awareness of the risk and failure to take reasonable care anyway. But, these would all be questions of fact for a fact finder (i.e. the jury, or the judge in a bench trial) at trial, not a matter of law.
If the employee was held to have liability, the company would have vicarious liability (unless it was a government agency in the U.S.), but the company could have liability other than vicarious liability for failure to have adequate policies in force, or for failing to implement policies that only existed on paper, even if the employee was not held liable.
Employer Suits Against Employees
The theory of relief if the company sued the employee would be different. This would be based upon a breach of a duty of care arising under the fiduciary agency-principal relationship of an employee and an employer. Failure to observe a written policy of the employer would hurt the employee's case, although not as much if the policy wasn't enforced as if it was enforced or emphasized. But, this would still ultimately be an issue of fact to be decided at trial.
This suit would also be more likely to be a bench trial than a jury trial, as the existence of a right to a jury trial in a case like this one is not clear, because internal company matters and disputes between agents and principals were historically handled mostly in courts of equity, and cases that historically were handled in courts of equity are not eligible for trials by jury.
The finder of fact would probably be predisposed to find in favor of the employee, notwithstanding the law it was instructed upon, because it is very rare for employers to sue employees for failing to perform their duties competently, as opposed to merely firing them for failing to do so, in practice, and in light of that background, and the fact that almost all jurors and judges have been employees in their lives, while far fewer have been employers, they would tend to see the issue from the employees perspective. The prevailing understanding in the community about the kind of circumstances when an employee should be liable to an employer has considerable influence on a judge or jury since that person has so much discretion.
Password123is not a reasonably secure password by any measure, yet it was found over 22000 times in the HIBP database.