[yesco]

I was under the impression that the key concern here is being criminally prosecuted, not sued. Even if they obviously didn't do this on purpose, depending on how they communicate it to the companies involved, the worse case scenario is that it could be perceived as some kind of phishing attack / fakeout done with malicious intent. Even if they could prove their innocence, no one wants to deal with something scary like that in court.

While I'm not familiar with the nuances of each European nation's computer fraud laws regarding this, I can't imagine this would be any different there. Especially as Cybersecurity becomes an increasingly international concern.