Forensic investigation and incident response - Customer notification (legally required in most jurisdictions) - Credit monitoring and identity theft protection for affected individuals - Regulatory fines and penalties - Legal fees and settlements