Fintech: Obligations after a data breach