After reading the Sample Data Breach Notification there are a few different economic theories and social science theories that can relate to the letter. 

The first economic theory that comes to mind is rational choice which states that individuals/businesses make choices that are in their best interests.  This relates to the letter because the company outsourced the website platform likely because it was more cost effective and therefore in their best interests but may reconsider that going forward since the cost of the data breach to the company reputation may drastically change the risk/reward for not keeping the cybersecurity systems all under company control by not outsourcing.  The second economic theory that comes to mind is the Marxian economic theory which states that people/businesses with power will exploit those without power for economic gain.  This comes to mind because of the fact that large corporations keep the information data on their customers and monetize it and the individual who is less powerful does not have much recourse, if any, to address breaches of privacy that occur such as from a cybersecurity breach as mentioned in the letter.  The first social science theory that I think of with regard to this data breach is conflict theory which is similar to Marxian economic theory in my opinion as it focuses on how those with power can use their power to create inequality via digital technology.  Therefore it again is relevant as corporations make a conscious effort to obtain and keep information on individuals with the motive of profit with the risk that the personal information can be compromised but when it happens there is generally nothing of note or real consequence that happens to the powerful corporation whereas the individual may have their identity stolen and be severely impacted.  The second social science theory that seems relevant to me would be symbolic interactionism which is the study of how individuals interact in the digital world.  I think this could be relevant because if data breaches continue to occur and individuals become less trusting of the ability of companies to protect their personal information then they may interact with those companies differently which could lead to adverse impact on profits of the company depending on how the behaviors change.