A few points that might help put this into context (oversimplifying a bit):<p>1. In general, negligence law works to prevent people and companies from imposing the <i>costs</i> of their actions on others, that is, externalizing those costs, while retaining the <i>benefits</i>.<p>For example, suppose that a pizza delivery guy drives too fast. Perhaps he wants to make more deliveries during his shift and thereby earn more money. Whatever the reason, suppose also that the pizza guy hits a parked car with no one in it (to simplify the example).<p>In that situation, the pizza guy (and his employer, but that's another discussion) likely will have to pay to have the other car fixed, and for a rental car for the other car's owner. The rationale is that the pizza guy and his employer shouldn't be able to retain the benefits from his fast driving while making others, i.e., the owner of the car he hit, bear the resulting costs.<p>(That, incidentally, is why drivers in many jurisdictions are required by law to carry liability insurance -- so that if a driver does negligently get into an accident, there will be a pre-established pool of money that can be tapped to pay for the resulting damage, even if the driver himself happens to be broke at the time.)<p>--------<p>2. Negligence can be loosely paraphrased as a failure to use due care <i>when there's a duty to do so</i>. In any given case, it might be debatable whether a duty of care existed, and if so, whether the defendant complied with that duty. In assessing these questions, courts generally look at, for example:<p>+ the likelihood and magnitude of the potential loss from the conduct in question (i.e., the expected loss);<p>+ the incremental cost of additional measures to prevent the expected loss;<p>+ in the case of a business, whether that incremental cost can be amortized across the business's customer base by the business's buying insurance (or self-insuring) and then increasing its price accordingly;<p>+ which party is in a better position to take measures to prevent the expected loss, and/or to bear the loss if it comes to pass.<p>For the mathematically-minded: A famous case studied by all U.S. law students is <i>United States v. Carroll Towing Co.</i> [1], where the opinion was written by the legendary judge Learned Hand (yes, that was his name). Judge Hand put it in algebraic terms:<p><i>"Since there are occasions when every vessel will break from her moorings, and since, if she does, she becomes a menace to those about her; the owner’s duty, as in other similar situations, to provide against resulting injuries is a function of three variables:<p>"(1) The probability that she will break away;<p>"(2) the gravity of the resulting injury, if she does;<p>"(3) the burden of adequate precautions.<p>"Possibly it serves to bring this notion into relief to state it in algebraic terms: if the probability be called P; the injury, L; and the burden, B; liability depends upon whether B is less than L multiplied by P: i.e., whether B < PL."</i><p>--------<p>3. So how does this apply to criminal hacker break-ins? Suppose that: (A) a company fails to use "due care," whatever that means, by way of security precautions; and (B) as a result, third parties are damaged in ways that "reasonable people" would have foreseen. In that situation, it's not hard to imagine that the company might well be held liable for such damage.<p>As a practical matter, in a negligence trial, the plaintiff's lawyers will often think up additional precautions that the defendant supposedly could have taken without undue cost or burden. The defendant's lawyers are then in the position of having to convince the judge or jury that the cost or burden would indeed have been "undue." That can be an uphill battle, especially when the plaintiff is a sympathetic sort and the damage is something that judges and jurors can identify with.<p>[1] <a href="http://en.wikipedia.org/wiki/United_States_v._Carroll_Towing" rel="nofollow">http://en.wikipedia.org/wiki/United_States_v._Carroll_Towing</a>