From avrguru:
To some extent, the question of cost has been made moot by legistation such as Sarbanes-Oxley. Worse still, negative publicity from an exposed customer database has cost many companies dearly, in terms of dollars spent to rectify as well as intangible costs such as reputation.