But you can't - when it includes damage to the provider e.g. brand tarnishing.
A lot of user-access "security" is for the benefit of the provider, not the user.