As cyber risk continues to expand, data processing vendors may find themselves in more protracted negotiations over who will absorb the bulk of the liability.