Financial impact of hacking is small, new RAND study says