I'm not your lawyer, but it's imperative to consult one ASAP. The cracker's at fault, but your liability depends on the contract with your client and your local laws. They can be complex, and each case is unique. Check the legal advice subreddit for basic pointers but get a professional …