For risk managers - indeed for most businesses - among the most disturbing words they can hear are "We've been hacked."