I'm trying to create a very general example, i know there are surely hundreds of variables that must be analyzed but even just some general considerations from who had some experience can be useful for me.
A - The programmer who wrote the website. He had wrote a "not so secure" code because it loss in experience. He's employed at Agency B
B - The web agency who had employed "Programmer A" with a regular contract
C -The the customer who ordered the construction of the site to Agency B
A quite standard website, where users can register and store personal information
An hacker broke the light defense of the website and acquires many personal information of the users registered to the site. It can broke the system because the Programmer A had wrote a very poor code.
Who is liable?
1 - Programmer A because for the Hacker it was too simple to hack the site.
2 - The Agency B because she was how sells the website to the customer. The agency B can only dismiss the Programmer A
3 - The Customer C because he's the owner of the site