Someone in my company had their identity stolen and is coming after the IT department for negligence. It was my understanding that the person who committed the theft is the liable party. However I am having a hard time finding any reliable legal information on the web. Has this happened to anyone here? I know it's not a technical question but any guidance would be appreciated.