My goodness, this is a mess.
Let me see if I got it:
IBR needs an IT project performed and contacts X to find an independent contractor to perform the project. X contacts Y to request someone to staff. X and Y have a contract between each other. Y turns around and hires Z for the actual contractor to be supplies all the way up the chain to IBR.
IBR sends out a computer on which the contractor is to perform her work. Y installs the network on the computer and gives it to contractor. Contractor then takes the computer and hires someone else to actually do the work.
The work is done, and it is done correctly, but IBR is concerned because there has been a breach of privacy
and confidentiality regarding the access to their network.
Is my summation correct?
You want to know who is liable for what, correct?
In order to sue on a contract, there must be privity (i.e., the party suing must have a contract with the party being sued). IBR only has a contract with X. X only has a contract with Y. Y only has a contract with Z. Z is contractor's employer.
Contractor committed fraud
and is liable to X, Y, Z and IBR.
Z breached its contract to Y by failing to make sure that the contractor was qualified, trained and supervised.
Y breached its contract to X by failing to deliver a qualified contractor, as did X breach its contract to IBR.
X,Y,Z, and contractor all owed duties of confidentiality to IBR. IBR may sue EVERYONE for this breach, if there are actual provable damages.
There will be joint liability between X,Y,Z, and contractor for the breach of confidentiality
. You (Y) need to point your finger at Z and the contractor, who are both really at fault here.