Imagine this nightmare scenario: You’ve contracted with a vendor to enter personnel data into a new computer system, including employees’ Social Security numbers, addresses, names of dependents, health records and bank account routing numbers. Then the vendor notifies you that employee data was somehow stolen or lost. What do you do?