Let's assume that Hacker Corp. offers a penetration testing service to other businesses, and ACME Corp. contacts Hacker Corp. to conduct a penetration test for some internal testing.


Hacker Corp. requires ACME Corp. to sign a "Permission to Attack" document, which outlines that Hacker Corp. is allowed to attack a specific system of ACME Corp. during a specified timeframe in a specified way.


Due to internal turmoil in ACME Corp., the Permission to Attack document never gets signed by the people with the powers to sign it, and instead a low-level IT employee in ACME Corp. signs instead. During the penetration test, a machine in ACME Corp.'s infrastructure fails and causes an outage, which costs ACME Corp. millions of dollars. This failure was not foreseeable and not caused by negligence.


ACME Corp. now wishes to sue Hacker Corp. for damages, claiming they were attacking ACME Corp. without a valid Permission to Attack. Can Hacker Corp. claim that they acted in good faith, believing that the Permission to Attack was granted by someone from within the company who was allowed to grant such a permission?



Can a company claim they acted in good faith in this situation?