It may be a cliché but it can’t be said enough: where security breaches are concerned, it’s not if but when.