Never trust the first number announced in a data breach