My website was hacked: is the web host, the agency or me responsible?

In short

If your website or store is hacked, you are the one responsible toward your customers and the data protection authority, as the business owner and the party in charge of the data; the web host answers for its server and the agency for what you agreed in writing. Whether the host or the agency has to pay for anything depends on the contract and on whether they failed their own obligations, not on the hack itself. If personal data is affected, notifying the authority (within 72 hours under the GDPR) is your job.

It is one of the first questions I get when a hacked store comes in: “Shouldn't my host have prevented this?” or “Isn't this the agency's job, since they built the site?” The short answer is that, toward your customers and under data protection law, you are the one responsible, and what you can claim from the others depends on what you agreed with them. I explain it from the technical side, which is mine; for the legal side of your specific case, talk to a lawyer.

By Jose SorianoLast updated: October 24, 20267 min read

The short answer

Who	What they are usually responsible for	What it usually doesn't cover
You (owner of the website or store)	Your customers' data, toward them and the data protection authority; deciding who has access; hiring (or not) maintenance	You can delegate the work, not the responsibility
The web host	The server: operating system, isolation between customers, network, the PHP versions it offers and its backups, if included	The WordPress, PrestaShop or application you install, its plugins or modules and your passwords, unless your plan says otherwise
The agency or developer	Whatever the contract says: building the website, and maintaining and updating it only if you hired that	Flaws discovered after the website was delivered, if there is no maintenance contract
The attacker	The crime	In practice, they are almost never identified

The usual split. What counts in your case is what each contract says.

Why it is you: the GDPR, the EU-wide data protection regulation, calls the party that decides why and how personal data is used the controller, and on a store or a website with forms that is you. The host and the agency, when they process that data on your behalf, are processors: they have obligations of their own, but they don't replace yours. Outside the EU the names and rules change from country to country, but the idea that the business owner answers for its customers' data is common.

The GDPR applies across the EU, and it can also apply to businesses outside the EU that sell to people in it. The articles that matter here:

Article 32 (security): controller and processor must apply security measures appropriate to the risk. For a website, that includes things as basic as keeping the software up to date and having backups that can be restored.
Article 28 (processors): anyone who processes data on your behalf (host, agency, maintenance provider) must do so under a contract or agreement that sets out what they do with it and what security measures they apply.
Article 33 (notification): if there is a personal data breach, you notify your supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk. A processor that discovers it must inform you without undue delay.
Article 82 (liability): the processor is only liable for damage when it has not complied with the obligations the regulation places on processors or has acted outside your instructions.

How to notify, step by step, in data breach in your online store. In Spain, the supervisory authority is the AEPD (Spain's data protection authority), which has a tool to assess whether you need to notify; elsewhere in the EU, it is your country's supervisory authority.

The host: does my shared hosting protect me?

Shared hosting protects the server, not your application. It maintains the operating system and the web server, separates your account from other customers' and usually offers backups and some kind of malware scanner. What happens inside your folder (an outdated WordPress plugin, a PrestaShop module with a published flaw, a reused admin password) is your responsibility unless your plan explicitly says otherwise.

Read your plan's terms. Look for words like “automatic updates”, “malware removal”, “managed WordPress” or “backups”: if they are there, the host takes on that part; if not, it doesn't.
The host's scanner warns, it doesn't clean. Many hosts detect malware and suspend your account or send you a notice to protect their other customers. It is a good alarm signal, not a cleanup.
When it can be the host: if the intrusion came through the server (another account on the same server, the hosting control panel, an unpatched PHP or web server version you cannot change yourself). It is uncommon, and it is proven with their logs, not with assumptions.
Ask for the logs (access and error logs) for the days of the attack: many hosts keep them for only a few days. And for the backups from before the intrusion, if they have them.

The agency or developer

An agency having built your website doesn't make it responsible for every later hack. Flaws in WordPress, PrestaShop and their extensions are discovered and published every week; if nobody updates the website after delivery, the risk grows over time even if it was delivered in good shape.

If you have a maintenance contract with the agency and it includes updates or security, ask what was updated and when. If the way in was a plugin or module with a patch published months earlier that was never applied, that is a conversation to have (and, if it isn't resolved, with a lawyer and the contract in front of you).
If there is no maintenance contract, the agency is generally not responsible for flaws published after delivery. There can be responsibility if it left something done wrong from the start: a pirated (nulled) module, an admin user with a default password, a public backup or debug mode switched on.
Always ask for the access details and the list of what is installed: users, plugins or modules, where they came from and their licenses. If you change providers, get them handed over in writing.

What is up to you, in order

Contain it: if payments or data are at risk, disable the affected payment method or put the store in maintenance mode. The first hour is covered in recover a hacked website.
Keep evidence: a copy of the files, the database and the logs as they are, before cleaning. Without them you won't be able to prove anything to anyone.
Assess whether personal data is affected and, if it is, notify the supervisory authority within 72 hours (and the customers if the risk is high), as the GDPR requires.
Clean up and close the way in, with a report of what was there and how they got in.
Review the contracts with the host and the agency with that report in hand, and decide who takes care of maintenance from now on.

If you need free guidance in Spain, INCIBE's 017 (INCIBE is Spain's national cybersecurity institute) is the cybersecurity helpline for citizens, businesses and professionals: free and confidential, every day from 8:00 to 23:00 Spanish time, with the contact channels listed on its website. They tell you what to do; they don't clean the website. Many other countries have a national cybersecurity agency that publishes similar guidance.

If you want me to look at it

Cleaning a hacked WordPress site costs €219 and a PrestaShop or WooCommerce store €349, excluding VAT, with a 90-day guarantee. Both include a report of what was there, how they got in and since when, and for stores, technical guidance for the breach notification to the data protection authority. So it doesn't happen again, website maintenance costs €35/month for a website and €69/month for a store, with no lock-in. More details in hacked website repair.

Sources

General Data Protection Regulation (GDPR), official text on EUR-Lex: articles 4 (controller and processor), 28, 32, 33 and 82.
EDPB: Guidelines 01/2021 on examples regarding personal data breach notification
AEPD (Spain): guide to managing and notifying personal data breaches (in Spanish)
AEPD (Spain): Asesora Brecha tool (assess whether you need to notify; in Spanish)
AEPD (Spain): breach notification on its e-office (in Spanish)
INCIBE (Spain): 017 cybersecurity helpline (free; hours and channels; in Spanish)

Frequently asked questions

Is my web host responsible if my website is hacked?

Usually not: the host answers for its server, not for the WordPress, PrestaShop or application you install, or for its plugins or modules. Only if your plan includes updates or cleanup, or if the intrusion came through the server itself, may there be something to claim, and that is proven with the logs.

Is the agency that built my website to blame?

It depends on the contract. Without a maintenance contract, it is generally not responsible for flaws published after delivering the website. With maintenance that included updates, or if it delivered the website with something done wrong (pirated modules, default passwords, public backups), there can be responsibility.

Who has to notify the data protection authority if data is stolen from my store?

You, as the controller: under the GDPR, within 72 hours of becoming aware of it, unless a risk to people is unlikely. In Spain, that authority is the AEPD. If the host or the agency discovers it, they must inform you without undue delay.

Does my shared hosting protect me from hacks?

It protects the server and usually warns you if it detects malware, but it doesn't update your website or clean what is inside your account unless your plan says so. Most intrusions come in through a plugin, a module or a password, which are your responsibility or that of whoever maintains the website.

Can I ask my host for the logs of the attack?

Yes, and the sooner the better: many hosts keep access logs for only a few days. Ask for the backups from before the intrusion too.