Right. I think the reasonable complaint in these cases is that the damages should cover the cost of <i>investigation</i> that resulted directly from the breach, not the cost of fixing the original security vulnerability and&#x2F;or auditing the entire system.<p>If you break into a bank, then the bank is right to ask for damages of amount stolen + amount necessary to sweep their building for any backdoors you might&#x27;ve added and repair any damage. That&#x27;s fair. They shouldn&#x27;t be suing for the cost of an upgrade to their security system or a new training course for their security officers.