cybersecurity penalties