The right thing to do is often easy, technologically. The harder part for an organization is deciding "yep, we want to e-mail everyone on our list and tell them we made a big mistake".