What are cybercrooks looking for?

Which corporate assets should be first in line for protection against cyberattacks?