"may need to expend significant capital and other resources to protect against the threat of security breaches or alleviate problems caused by breaches." . . . .