The law in California is complicated, and appears to hold that a company is liable if they "knew or should have known" the information they were using was misappropriated. This came up a bunch back in the SCOX v. IBM days.