Data Breach Preparation and Response: Breaches are Certain, Impact is Not