Liability for a cyber attack is not limited to the attackers. An attack may be foreseeable in some circumstances, and the failure of the target or the other entities to take steps to prevent the attack can constitute a breach of duty to injured victims.