[jameshart]

The reason the investors care is presumably because of the fear that there will be significant, material financial consequences for the business arising from harms that affect the users.

If the expectation was that users were screwed and would not be entitled to any compensation, then the news of this breach would be no more material to the company’s investors than learning the at the air conditioning was set to the wrong temperature in one of the company’s offices for a few hours.