If a website receive an attack by an Hacker, who is evanutally liable for the data breach?

Question

I'm trying to create a very general example, i know there are surely hundreds of variables that must be analyzed but even just some general considerations from who had some experience can be useful for me.

3 actors:

A - The programmer who wrote the website. He had wrote a "not so secure" code because it loss in experience. He's employed at Agency B

B - The web agency who had employed "Programmer A" with a regular contract

C -The the customer who ordered the construction of the site to Agency B

The website:

A quite standard website, where users can register and store personal information

The attack:

An hacker broke the light defense of the website and acquires many personal information of the users registered to the site. It can broke the system because the Programmer A had wrote a very poor code.

Location:

Italy

Who is liable?

1 - Programmer A because for the Hacker it was too simple to hack the site.

2 - The Agency B because she was how sells the website to the customer. The agency B can only dismiss the Programmer A

3 - The Customer C because he's the owner of the site

Answer 1

There are many other variables not mentioned here, and I think it comes down to 1 question:

Who is liable for a data breach?

The programmer

Not responsible, unless they intentionally left a hole in the system.

The agency

Not responsible. Generally agencies require the client to test and sign off, and the client takes responsibility / ownership of the site and data, and having it maintained.

The client / owner of the data

Responsible, if it can be proven that they have been negligent. Providing they have taken appropriate precautions in protecting the users data, they are not responsible for the Hackers crime.

Any lock can be broken. You don't blame the victim or the creator of the lock. You blame the criminal.

Like you are responsible for locking your car door. A company is responsible for protecting their customers data, but there is only so much they can do.

The hacker

Is not responsible for a data breach. They are guilty of a crime against the Client and its customers.

Ultimately

The hacker is guilty of a crime, and the client storing the data is responsible for a data breach if they didn't take appropriate steps to protect it.

If the Client gets fined, they could try and counter sue the agency, but hopefully the agency has a contract that protects them from this.

Answer 2

A, B, C and the hacker

Why do you think only one person would be liable? An aggrieved party sues as many people as possible and, if successful and depending on the law, either the court decides the proportionate liability or all the defendants are jointly and severally liable in which case the litigant looks to the one with the most money or best insurance. In practice, the litigant would sue the owner of the site who would “join” the others as co-defendants.