...just the tip of the iceberg, because in practice you can’t nail down the lost sales, reputation damage and future legalclaims that are directly attributable to the incident. Security researchers, most notably the Ponemon Institute, have...
http://www.computerweekly.com/blogs/david_lacey/economics-of-security/