Negligence is absolutely a part of US criminal law, though - the canonical example being "firing a shotgun into a tent even if you don't know someone is inside it". See "negligent homicide" etc.
Civil negligence would apply here but that would be limited to recovering damages.
The hacked website could sue to recover costs incurred, but what costs were incurred here? Maybe some wasted network bandwidth but that’s minimal.
You have to point to monetary losses caused by the hack. Only that would be covered.
Negligent homicide doesn’t apply because no one was killed.
The law is much more broad than CFAA!
Outside of the CFAA, what criminal charge do you feel is applicable here?