What's worse than getting breached because of lax security practices? Sweeping it under the rug.