Incentives to Invest in Data Security