According to the Network Security/Safety (it's the same word in Chinese) Law, the network operator is responsible to ensure the security of their system, which

According to the Network Security/Safety (it's the same word in Chinese) Law, the network operator is responsible to ensure the security of their system, which includes 1) setting up security and auditing rules, 2) prevent virus, hacking and other attacks, 3) monitor and record the status of the network and perform backups etc. The law has also stated that if an institution violated the law, and civil damages is generated as result, the institution is also responsible for the damage. There is another law which might also apply to this case, it's called Data Security/Safety Law. This law also stated that the institution is responsible for civil damages if the institution has violated the law. But, I'm not a lawyer and certainly not a Chinese lawyer. This situation is fairly complex already, it's hard for me to tell which direction this case would go. I guess they'll investigate it first, but the company/team which worked on the project has probably already read the laws before, thus I assume they're well-prepared for this. Another twist is the programmer who accidentally published the secret database API key to the public network, this needs to be investigated as well to determine whether or not the key has actually been used in the attack. So I guess in the meantime, the husbands must wait.