What to do if a database is stolen?