Stolen 3rd party proprietary information

Assume that I have a customers credit card & teh complete information in my data base by permission, to use to make purchases on their behalf. Let's say that the system was hacked into and that information was stolen. Other than contacting the customer & Credit Card co., am I required, by law, to do anything else?