This finding is hardly given the increase in regulatory requirements, in addition organizations are not only operating at a state or federal but across international jurisdictions.  Every jurisdiction brings with it a layer of complexity that MOST organizations, unless they have executed a data protection or incident response strategy.  

The cost of informing the end consumer is rising as is the cost to support them on an ongoing basis, toll free numbers and the ongoing credit checking requirements add to the cost of the initial reaction to the breach and the specialists required to forensically investigate.  The PR efforts and disclosure to the legal authorities and the media unless thought out prior to the incident could mean the difference between survival and extinction.

Remember that Information Security is... NotJustForSquares.com