“Negative valence driven by security breach language and governmental implication, framed as a failure rather than a neutral event.”