Customer data breached and site hacked — legally and contractually, who's responsible?

Instead of pointing fingers right now, take these three steps immediately: 1) If the 72-hour official notification window hasn't closed, file a preliminary breach notification with the state data protection authority. 2) Take a full server snapshot to freeze the evidence; do not do a clean reinstall just yet. 3) Consult an attorney who specializes in IT law.

Standard agency contracts almost always include a clause stating "the agency cannot be held liable for security vulnerabilities arising from third-party plugins." For a low fee like 350 EUR a month, there's no way they provided comprehensive vulnerability and pentesting coverage. Legal fees will likely end up higher than whatever payout you'd squeeze out of them anyway.

We went through a similar incident two years ago. We paid 4,800 EUR for incident response and a digital forensics report, and 3,200 EUR for a specialized lawyer. Because we notified on time and kept the whole process transparent, the data protection office didn't fine us, just issued a formal warning. The lawsuit we filed against the agency dragged on for 14 months and ended in a partial settlement.

You need to understand the legal distinction: In external relations (the authorities and affected individuals), you alone are responsible. In internal relations, the contract between you and the agency comes into play. If you never signed an AVV (Auftragsverarbeitungsvertrag) with them, the regulatory authority could also penalize you simply for having data processed without a contract.

When this happened to us, the agency claimed "the server was hit with a brute force attack, our code is clean." We brought in an independent expert to investigate; turned out two-factor authentication wasn't enforced on the admin panel and a well-known form exploit had been left unpatched for 6 months. Once we dropped that report on the table, the agency's professional liability insurance covered half our damages.

Does your contract specify an update frequency? Like a clause saying "critical patches applied within 48 hours"? Also, were passwords and customer data in the database hashed and salted, or sitting in plain text?

claassic triangle: The agency blames the hosting provider the host blames the plugin developer and the plugin developer is nowhere to be found and meanwhile the bill always lands on the domain owner... anyway call your lawyer now, imo.

Edit: asked below, I wrote the answer in the second message.

I agree with this. Trying to do this alone is the most expensive way.

If 2FA is on a stolen password alone is useless. Of course, it varies if your situation is different.

Following.

The opposite happened to me, that's why I'm writing. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

This is my opinion, I'm not claiming it's absolute truth.

looking at it as a process, the picture changes. i mean don't hesitate to ask; those who don't ask always pay more.

if you post the result here, it will help others too.

i didn't know that.

Correct in theory but it doesn't work that way in practice. honestly any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Processes without records never improve because you dont know what to fix. I mean hope this helps.

The discussion got scattered let me summarize. Security isn't absolute; it's about making attacks not worth the effort.

Hope this helps.

Three different views emerged, they all complement each other. The answer varies greatly by industry; there is no one-size-fits-all rule.

Of course, it varies if your situation is different.

Thanks for writing this, that's the right way. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

Just leaving this note, it might be useful.

I agree. Dont hesitate to ask; those who dont ask always pay more.

Following.