If person A was irresponsible, which is why they got hacked, then yes they owe person B money.
It’s a modern time everyone should know a little bit about protecting themself online. Also if it’s a card type thing, nobody should have other peoples information linked to their devices.
Overall needs more context