This company did everything right but still paid the price for a breach. Their IT plan was solid, but their prevention plan was lacking.