E-mails and passwords are one thing, credit card numbers are quite another. Firstly, you're going to get sued. Some law-firm is going to figure out you're a de

E-mails and passwords are one thing, credit card numbers are quite another. Firstly, you're going to get sued. Some law-firm is going to figure out you're a decent target, find someone aggrieved enough to be a lead plaintiff, and sue you. Maybe the law-suit is baseless, but you're still going to have deal with the expense and hassle of defending yourself. This is not cheap. The credit card issuers will come after you to reimburse them for fraudulent activity (because your merchant agreement almost certainly has a clause holding you liable should you be responsible for a data breach). Oh, and now the payment networks are insisting you provide a full PCI compliance audit, at your own significant expense. And whilst the Targets of this world typically have indemnity insurance that covers this kind of thing, Joe Startup does not. So yes, the news cycle is brief, and maybe the PR damage is minimal, but that's not what's going to hurt you. What's going to hurt you is the pain and headache of wading through the legal and financial crap-storm that's coming your way.