They should 100% be responsible for their action especially if holding other people money is involved.
This is not some game that manager is playing, and he always needs to be ready to pay money back from his own pocket, like Hhampuz done several times in past.
People should take situations like this more seriously, and simple ''sorry'' with blaming alleged mysterious hackers just wont do it.