Open for Business, Open for a Data Breach?