I'm trying to create a very general example, i know there are surely hundreds of variables that must be analyzed but even just some general considerations from who had some experience can be useful for me.
3 actors:
A - The programmer who wrote the website. He had wrote a "not so secure" code because it loss in experience. He's employed at Agency B
B - The web agency who had employed "Programmer A" with a regular contract
C -The the customer who ordered the construction of the site to Agency B
The website:
A quite standard website, where users can register and store personal information
The attack:
An hacker broke the light defense of the website and acquires many personal information of the users registered to the site. It can broke the system because the Programmer A had wrote a very poor code.
Location:
Italy
Who is liable?
1 - Programmer A because for the Hacker it was too simple to hack the site.
2 - The Agency B because she was how sells the website to the customer. The agency B can only dismiss the Programmer A
3 - The Customer C because he's the owner of the site