You're correct, there have been companies that quietly paid a million+ just to avoid litigation. It can cost certain companies tens of millions just to deal with a public security breach.