Hilton to pay $700K in data breach fines, but it could be much worse