The bank is at fault for the amount of damage due to their own negligence, which would be the amount greater than what it would have cost to re-key the locks.  And you have to re-key the locks instead of recovering the keys that had been issued, because you have no way of knowing whether the keys were copied or not.<p>In the case of username&#x2F;password keys, &quot;changing the locks&quot; can be done as easily as running an automated script nightly against the HR employee database, to suspend login privileges from anyone who is on leave or no longer an employee, or at worst, by having your sysadmin&#x27;s lackey, who makes $30&#x2F;hour, spend 2 minutes on doing that every time it is needed.<p>The people who broke in are responsible only for the damages they caused directly, not for the cost of fixing things that were already broken when they showed up, or for investigating and implementing measures to stop the next gang of vandals that might enter.<p>So what is the actual financial impact of a defaced web page?  How do you prove that?  If you give crowbars and sledgehammers to a gang of vandals, to what extent are you responsible for the damage they cause with them?  If they only use those tools for legit demolition work, are they obligated to pay you a cut of their revenue?