How to assess a data breach