The ones who are damaged by the negligence sues for negligence.

Similarly: those people who act recklessly can get sued for more, or even criminally prosecuted. Finally, someone who acts out with malicious intent can be sued / criminally charged with the highest crimes.

-----------

So in this "Sega" case: Sega can sue their security for the negligence.

Then, the hackers can be sued for something between recklessness and malicious intent.

Yeah, the law is flexible. "Justice" as a concept in the Western world revolves around both actions + intent. (With intent / state of mind in roughly 3 states: negligence, recklessness, and malice in that order).

Its a flexible system, albeit sometimes imperfect... but just applying it in a textbook manner to this case results in acceptable results IMO.