I think that potential damage to a company's reputation and possible harm to customers is worth counting. If it's something you'd have to notify customers about

I think that potential damage to a company's reputation and possible harm to customers is worth counting. If it's something you'd have to notify customers about... It just be somewhat sensitive data, not public information?