IT Security: How a $15,000 Attack Prompted Serious Change