I would bet they are charging as result of an insurance policy they have to cover them from data theft. I'm fishing from the top of my head here, but I think the federal government can fine a company up to a 100,000 for EACH person's contact information when it is stolen. We take security and data loss / theft very seriously at work.