The hacks probably fall under negligence not CFAA but the larger point stands that companies are always responsible for everything they do.