My 2p on this...
If the kid told them, before the hack, that "x" exploit was open, but they ignored him and did nothing, with a reasonable fix time, then they have been negligent and in my opinion, should be liable for their own security costs. (Bearing in mind, the kid does now have a criminal conviction over and above their sueball.You can't sue a burglar for the cost of a security system, after leaving your windows open.)
If however, this was a straight black hat hack, then yes, he should be liable.
It doesn't state if this was the case or not.
Biting the hand that feeds IT
