If it's an LLC/Corp you should be protected by the corporate veil unless you've otherwise documented you're committing criminal behavior.

But yea, the lack of security standards across organizations of all sizes is pitiful. Releasing new features always seems to come before ensuring good security practices.