Ouch, sorry to hear that. Make sure whoever you hire specializes specifically in privacy and data breaches, not just general corporate law. The notification timelines and regulatory requirements are brutal if you mess them up.

Yeah my dad still does the 3,000 mile oil change. I showed him the manual for his own car and he just shrugged. It's like some habits are glued in place.