So who is going to pay in the event of a hack?