Records × published cost.
Liability = the number of sensitive records you hold, times a per-record breach cost from IBM's Cost of a Data Breach and the Verizon DBIR. PHI $408/record, PCI $295, PII $180, credentials $150 — you see each line of the math.