re: What is the responsibility of the employer....

All of this depends on a few factors


There is no such thing as a system that cannot be hacked.

The ultimate responsibility falls on organization Senior Leadership to push governance and compliance. They need to lead the security culture.

Did they do their Due Diligence in creating an Information Security program to meet industry standard security practices?

Did they exercise Due Care and implement those security policies and controls? Did they have audits to ensure they were following controls? Did they mitigate risk found in their audits?

If the answer is yes to all that, then legally they acted as a prudent person would do and aren't going to be liable for anything.


If the answer is no, then there is culpable negligence and are probably vulnerable to a lawsuit.


So like all vague questions in life, the answer is... maybe.