It’s difficult for boards to ignore cyber attacks, least of all the damage they cause to brand and reputation.