Someone in my company had their identity stolen and is coming after the IT department for negligence. It was my understanding that the person who committed the theft is the liable party. However I am having a hard time finding any reliable legal information on the web. Has this happened to anyone here? I know it's not a technical question but any guidance would be appreciated.
Is there even any evidence that the thief gained the information through your company? I know that I do a whole lot more shopping, etc, on the Internet from home than I do from work.