The average cost of a data breach involving fewer than 10,000 records was $5 million