From a cybersecurity perspective, it’s been a tough year for the Hard Rock Hotel & Casino in Las Vegas, Nevada. This week, the company announced its second large data breach in just 14 months.

First, in May 2015, the company announced that hackers stole customer credit and debit card information from its system—including card numbers, CVV codes and names. The hack took place between September 2014 and April 2015.

This week, the company followed with another announcement that a second breach took place between October 2015 and March 2016. Customer names, verification codes and card numbers were again exposed, as were expiration dates. The company is now urging customers to check their credit reports and card statements for signs of fraud.

The series of hacks against the Hard Rock Hotel & Casino should be an important reminder that the first data breach is not always the last. Like sharks to chum, hackers will often flock to a breached network searching for additional ways of exploiting it.

The data breaches also bring to light another important question that many lawmakers are now asking: Should businesses be forced to compensate customers for damages?

“The answer, at least so far, has largely been no,” Wall Street Journal reporter Nicole Hong explained in an article this week. “While breaches at companies like Target Corp. and Home Depot Inc. have spawned dozens of lawsuits from customers blaming them for shoddy computer security, judges have mostly dismissed these suits at an early stage, finding that customers couldn’t show that the breaches caused them any actual harm.

While some companies do opt to settle customers’ claims and wind up paying class action lawsuits, this is not standard practice. And as WSJ pointed out, Home Depot and Target have even argued in court that they were not obligated to protect their customers’ data.

Still, as the article points out, some federal judges are, in fact, allowing such lawsuits to commence with the belief that identity theft should be considered a personal injury, and could warrant financial compensation.

Will there come a time when businesses are forced to compensate customers following a data breach? That day is still far off. But keep in mind that if your business is hit with a data breach, you will have to answer hard-hitting questions about your data security policies.

Take our advice: You don’t want to go down this path. Instead of cleaning up after a data breach and answering difficult questions, you should instead be striving to protect your sensitive data now.

Apex Technology Services can work with your organization to identify vulnerable areas of the network and protect it. By partnering with Apex, you can take the first step in avoiding a costly and complicated data breach. Plus, you will gain ongoing support and guidance from a team of expert professionals who are trained to combat cybercrime.

A new breed of hacktrepeneurs has awoken and they have little to fear and everything to gain by infecting as many companies as possible and extorting money from them. Apex Technology Services stands ready to protect your company regardless of whether it’s located in New York City, White Plains,Connecticut, Australia, Europe or anywhere else. Our full suite of cybersecurity and IT support services is at your disposal so you can spend less time worrying and more time growing your business.

In addition, our new Cybersecurity Compliance Certification for law firms will help keep your firm from becoming the next Panama Papers victim. This baseline cybersecurity audit for the legal industry should be considered seriously by all firms.