What was once dismissed as an IT nuisance or a post-breach cleanup task has hardened into a national liability.