Drake International, a Canadian job placement firm, has been a victim of a hacking scheme. The hackers stole a database containing the names, email addresses, phone numbers, and passwords of over 300 000 clients in Canada, Australia, the United Kingdom, and New Zealand. They demanded $50 000 to keep the stolen information private and not publish it on the Internet. The database that was compromised was an old database built under outdated security practices that included unencrypted passwords. What is the risk to Drake of threats from a group of hackers after a security breach? How could Drake have identified and addressed this risk in advance? How should Drake respond to the hackers?