The Washington Post should claim service credits or something from Instart Logic, considering it seems the CDN was at fault here.
Pretty sure service credits wouldn't approach the cost of the hack. Generally contracts are written to minimize liability in cases like this, too, although that is probably the lesser of two evils.