How about, for unauthorised access to have occurred, the data accessed must have been 'secured', with 'secured' defined according to industry practices. If I t

How about, for unauthorised access to have occurred, the data accessed must have been 'secured', with 'secured' defined according to industry practices. If I told a client that I had 'secured' their website, but access was available by incrementing an integer, they could sue me and they would win.