We're told data breaches cost millions on average - but this security study disagrees