I agree it wasn't authorized, but I should absolutely still be able to hold the company responsible for the damage. My business relationship is with you, not your employees or vendors.
They in turn could go after the perpetrator. If they're using contractors who are cheap, unvetted, untrustworthy or don't carry liability insurance that's their problem and shouldn't excuse them of accountability.
I'm not up to date on Tort law but it does seem likely the company has some liability here. I still think it's wrong to say the company did the thing. Someone employed by the company did it of their own volition. The company just gave them the ability to do the thing.