VA could spend $20M on data breach response