A jail term tied to stolen Spanish banking data is a reminder that financial records can keep generating risk long after the original intrusion is over.