Some targets have spent tens of millions just to notify customers and provide identity-theft monitoring.
